Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 2 replies
  • Subscribers 3 subscribers
  • Views 2868 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Clickjacking mitigation

SteveU

I'm presenting a web server through the WAF using Form authentication to restrict access.  This was recently scanned, and came up vulnerable to Clickjacking attacks.  Is there a way to add an X-Frame-Options or Content-Security-Policy: frame-ancestors header to the login form presented from the WAF?

Thanks.   -Steve



This thread was automatically locked due to age.
Parents
  • 0

    Hi  

    I don't think there's an option as such in WAF. In general, X-FRAME-OPTIONS is the web application's way to control how it's allowed to be presented the client-side, so don't you need to set this up in the backend application and not in WAF?

    However, you can add a feature request for this here.

    Regards

    Jaydeep

Reply
  • 0

    Hi  

    I don't think there's an option as such in WAF. In general, X-FRAME-OPTIONS is the web application's way to control how it's allowed to be presented the client-side, so don't you need to set this up in the backend application and not in WAF?

    However, you can add a feature request for this here.

    Regards

    Jaydeep

Children
No Data
Unfiltered HTML