X-Frame-Options Setting Malformed
- Risk:
Medium
- Type:
- Passive
- CWE:
- 1021
- Summary
- An X-Frame-Options header was present in the response but the value was not correctly set.
- Solution
- Ensure a valid setting is used on all web pages returned by your site (if you expect the page to be framed only by pages on your server (e.g. it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page to be framed, you should use DENY. Alternatively consider implementing Content Security Policy's "frame-ancestors" directive.