I run a couple of websites, so I'm just wondering what is the appropriate use of clickjacking protection like the x-frame-options response header? What pages are susceptible to this kind of attack on my users?


In general, every page which allows the user to change data is a potential target for clickjacking. The goal of clickjacking is to trick the victim into taking actions on the attacker's behalf. This affects every page with forms or buttons or other UI elements which have persistent effects.

However, I strongly recommend against taking the blacklist approach and picking individual pages for protection. It's very easy to overlook something, the pages may change over time, and even a seemingly harmless page can become dangerous through an additional vulnerability. For example, the attacker might have found a cross-site scripting vulnerability on your site. By combining this with clickjacking, they may be able to take arbitrary actions regardless of what you originally designed the page for.

The correct approach is whitelisting: You protect every page except those which absolutely must be framed.

Note that setting the header to anything other than DENY isn't reliable. When faced with nested frames, current browsers usually just check the top-level site. This means you can end up with situations like this: You allow the site good.com to embed your page as a frame, but this site also embeds evil.com. This allows evil.com to frame your page despite the X-FRAME-OPTIONS header being set to good.com, because the top-level site is indeed good.com.

So if you do allow framing, expect the page to be framed on any site, not just the one you've chosen.

  • Just wanted to add that not all browsers support the X-Frame option. If you're concerned with protecting users with older browsers you need to include frame busting java script on the pages you want to protect. – k1DBLITZ Jul 9 '14 at 14:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.