1

I'm checking some HTTP headers in the server response. I get a 404 error page. Could in some scenario an attacker leverage a missing X-Frame-Options header in a 404 page?

2
  • 6
    That depends on what the error page contains – MechMK1 Feb 22 at 9:22
  • 1
    no more or less than any other page. – dandavis 2 days ago
2

There is nothing inherent in a 404 response which protects against attacks like clickjacking (i.e. what X-Frame-Options tries to address). While most response bodies send with 404 are likely not vulnerable to clickjacking in the first place due to the shown content (i.e. just some more or less fancy error message), browsers do not add extra protection by themselves just because the response code was 404.

2
  • 1
    You are correct, there could be a fancy error page with clickable elements. -- but if the page is a standard 404 error page with no clickable content, there is no clickjacking risk. – Mark Koek Feb 22 at 12:22
  • 1
    @MarkKoek: Sure, if there is nothing to click on then no click can be hijacked. – Steffen Ullrich Feb 22 at 12:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.