We host a small (.Net) website for our customers; it's designed to be embedded within both our own hosted pages, and potentially within the customers own web applications (both internal and external). By far the most common way of doing this is embed it within a iframe
on the site.
So our site is explicitly designed to be within a frame; however, every vulnerability and web application security scan we run complains bitterly that we haven't set the Content-Security-Policy
and X-Frame
headers correctly. We currently have the CSP set as
Content-Security-Policy: default-src 'self'; script-src 'unsafe-inline' 'unsafe-eval' 'self'; style-src 'unsafe-inline' 'self'; img-src 'self' data:
(Why all those unsafe
? Because we use a component suite (DevExpress) that explicitly requires it.)
Even ignoring that, our security scans (via Tenable) complain that:
- 'frame-ancestors' should be set to 'none' to avoid rendering of page in <frame>, <iframe>, <object>, <embed>, or <applet>.
We're also "missing" an X-Frame-Options header:
The
X-Frame-Options
HTTP response header can be used to indicate whether or not a browser should be allowed to render a page inside a frame or iframe. Sites can use this to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites.
.. but the only options for this are DENY
or SAMEORIGIN
- we don't want either.
What CSP and X-Frame-Options should we specify for a site that is explitly designed to be embedded within another page?
EDIT: To give more context about the site in question: it's a hosted service, designed to be used by our customers for their own internal staff - it's not used, presented or designed to be available to public users (although the site is publically accessible, more for convenience for our customers to be able to access it from whereever their staff are).
More pertenantly: although the site is used to facilitate payments, it doesn't present or collect sensitive details in any way. In effect, it's just a "status" page - it shows the user the status of a transaction that's taking place in real time - it's effectively "read only" - and the only way for that transaction to progress is via a separate, and completely out-of-band process to be taking place. Without this process progressing, the page effectively just shows "Waiting ...".