Forum Discussion
NickLuckcuck_32
Nimbostratus
NimbostratusASM X-FRAME-OPTIONS identification of issues prior to deployment.
Hi All,
I am looking at deploying an ASM policy, this policy will activate the X-FRAME-OPTIONS header.
My question is: is there a sensible way of understanding if any of my customers are us...
samstep
Cirrocumulus
CirrocumulusThis is not easy as only the browser knows if a website is rendered in an iframe of a full window.
One way of getting that information is to use CSP (Content Security Policy) in Report-Only mode with the equivalent setting of X-FRAME-OPTIONS header and send reports to a CSP reporting service such as report-uri.com
Beware that if you find out that people are indeed "framing" your website they are just as likely to be hackers/attackers as legit customers - not quite sure how you would distinguish between them.
