Forum Discussion
Juergen_Mang
Mar 03, 2023MVP
K25232031 is interesting, thanks for the link.
About X-XSS-Protection: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
About X-Frame-Options: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
Adding a simple Content-Security-Policy will be the better way. I do not tested it, but this shoud suffice:
Content-Security-Policy: default-src 'self'; frame-ancestors 'self'
P.S.: I always change the Response Code to 403