CODEWITHSUNDEEP
node.jsiframecontent-security-policyclickjacking
Adam Freymiller
Adam Freymiller

Reputation: 1939

Content-Security-Policy frame-ancestors 'none' not working

I'm trying to disable all iframes from my website by setting it in the Content-Security-Policy headers of my response in the Node layer. According to Mozilla Developer Network, the property should look like this from the perspective of the client-side:

Content-Security-Policy: frame-ancestors 'none';

That's fine, here's how I'm setting it in the Node layer in my middleware:

app.use(function (req, res, next) {
    /* Clickjacking prevention */
    res.header('Content-Security-Policy', "frame-ancestors 'none'")
    next()
})

and here's how it appears in the client-side when I inspect network activity:

enter image description here

However, when I embed a YouTube iframe, such as the following:

<iframe
 width="420"
 height="345"
 src="https://www.youtube.com/embed/tgbNymZ7vqY"/>

it's not disabled. Why does the frame-ancestors policy appear to have no effect? Testing this on Chrome for what it's worth.

Upvotes: 3

Views: 9885

Answers (1)

jro
jro

Reputation: 940

frame-ancestors specify which pages can frame the current page.

If you want to limit the iframes that can be on the current page you can use child-src.

However, the child-src directive also applies to web workers. You can override it using the worker-src directive

Upvotes: 4

Related Questions