CODEWITHSUNDEEP
content-security-policyx-frame-options
zilcuanu
zilcuanu

Reputation: 3715

Replacing X-Frame-Options with CSP

I am migrating from X-Frame-Options to Content Security Policy to fix the click-jacking vulnerability. My application used to set the SAMEORIGIN policy in hte X-Frame-Options header. What is the equivalent option in Content-Security-Policy?

Upvotes: 9

Views: 5927

Answers (1)

sideshowbarker
sideshowbarker

Reputation: 88296

frame-ancestors

  • X-Frame-Options: SAMEORIGIN ➡ Content-Security-Policy: frame-ancestors 'self'

  • X-Frame-Options: DENY ➡ Content-Security-Policy: frame-ancestors 'none'

See also https://w3c.github.io/webappsec-csp/#frame-ancestors-and-frame-options

Upvotes: 14

Related Questions