We have set the set X-Frame-Options in the header as ALLOW-FROM same origin but there is a requirement to open below page from some 3rd party website. Do you see security issue here?
HTTP::header replace X-Frame-Options "SAMEORIGIN"
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
There is an
ALLOW-FROM directive to allow whitelisting of domains, however it is only supported by certain browsers.
X-FRAME-OPTIONS (or the new CSP equivalent frame-ancestors) could possibly make your site vulnerable to clickjacking or other attacks such as Cross Site History Manipulation.
Clickjacking is only really a risk if there's something to click. If your site has other input that the user needs to complete before any click would be registered, then the vulnerability would not be exploitable. This, however, is hard to determine without reviewing all site functionality. And then any further updates to your site may mean this becomes exploitable without you knowing. Often it is safer to disable framing unless there is definitely a business requirement for it.
The page can only be displayed in a frame on the same origin as the page itself.
You know this already, but I mention it to let you know that there has been, AFAIK, any vulnerability around this. By doing that, you rather added a layer of security to your web application by preventing clickjacking but this may not be enough: X-Frame-Options is worth less than you think.