X-frame-options response header configuration for Web security

The recent project is in beta and there is a "x-frame-options response header Missing" issue in the security report that may cause cross-frame scripting attacks such as:

　　

　　X-frame-options:

There are three values:

　　(1) DENY: Indicates that the page is not allowed to be displayed in a frame, even if it is nested in a page of the same domain name.

(2) Sameorigin: Indicates that the page can be displayed in a frame on the same domain Name page.

(3) Allow-from https://example.com/: Indicates that the page can be displayed in a frame of the specified source.

Configure Apache:

(If it is local, it is configured in httpd.conf; if it is Linux (Ubuntu) it is in apache2.conf)

Find an empty location.加入这行代码，具体看你是选择哪种


[Plain]View PlainCopyprint?

1. <span style= "FONT-SIZE:14PX;" >header always append x-frame-options sameorigin</span>

<span style= "FONT-SIZE:14PX;" >header always append x-frame-options sameorigin</span>

There might be a situation where I tried to Restart Apache after I had configured Apache on the server, but reported an error:

Invalid command ' Header ', perhaps misspelled or defined by a module not included in the server configuration

The header method module is not installed and we need to install it ourselves first:

Print?

1. <span style= "FONT-SIZE:14PX;" >add_header x-frame-options sameorigin;</span>

<span style= "FONT-SIZE:14PX;" >add_header x-frame-options sameorigin;</span>

To Configure IIS :

Configure IIS to send the x-frame-options response header, adding the following configuration to the Web. config file:

[Plain]View PlainCopy print?

1. <system.webServer>
2. ...
5. <customHeaders>
6. <add name= "x-frame-options" value= "Sameorigin"/>
7. </customHeaders>
10. ...
11. </system.webServer>

<system.webServer> ...  
Probably configuration is like this, before looking for the configuration of the iframe loading, see some articles said IFrame loading is easy to hijack, of course, there are methods of cracking, but no detailed to see, interested friends can go to understand the next!
X-frame-options response header configuration for Web security