vovchisko
2021-01-11 23:59:47
Not really. X-Frame-Options: DENY prevent YOUR page from being loaded inside an iframe.
X-Frame-Options: SAMEORIGIN - will block only loading from other domains.
It does nothing with iframes on the current page.
The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a , ,
Source: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
热门帖子
热门github
6
That explains! I was misinterpreting ClickJacking attacks as injecting a malicious iframe (by exploiting other vulnerabilities) onto the original webpage which could than be prevented by telling the browser to deny loading iframes. But that is not the case, thanks a lot.