IPFYI
RFC 7034 Informational

HTTP Header Field X-Frame-Options

D. Ross, T. Gondrom · 2013-10

Abstract

To improve the protection of web applications against clickjacking, this document describes the X-Frame-Options HTTP response header field, which declares a policy communicated from a host to the client browser on whether the browser must not display the transmitted content in frames from other sites.

Why This RFC Matters

RFC 7034 standardized X-Frame-Options, a widely deployed but previously non-standard HTTP header that major browsers had already implemented to combat clickjacking attacks — where an attacker embeds a target site in a transparent iframe to trick users into clicking on concealed elements. By specifying DENY, SAMEORIGIN, and ALLOW-FROM directives, the header gives site operators granular control over framing. Although the more powerful Content Security Policy 'frame-ancestors' directive has largely superseded it, X-Frame-Options remains a recommended defense-in-depth header in every major web security checklist and scanner.

관련 프로토콜

HTTPS HTTP

관련 용어

ssl-tls hsts authentication firewall

Security에서 더 보기

RFC 2404 The Use of HMAC-SHA-1-96 within ESP and AH RFC 3602 The AES-CBC Cipher Algorithm and Its Use with IPsec RFC 4253 The Secure Shell (SSH) Transport Layer Protocol RFC 4254 The Secure Shell (SSH) Connection Protocol RFC 4301 Security Architecture for the Internet Protocol RFC 5246 The Transport Layer Security (TLS) Protocol Version 1.2 RFC 5280 Internet X.509 Public Key Infrastructure Certificate and CRL Profile RFC 6125 Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS)