Clickjacking Protection Weakened

ID

csharp.clickjacking

Severity

high

Remediation Complexity

low

Remediation Risk

low

Remediation Effort

low

Resource

UI

Language

CSharp

Tags

ASVS50:v3.4.6, CAPEC:103, CWE:1021, NIST.SP.800-53, OWASP:2025:A06, PCI-DSS:6.5.1

Description

A server response weakens or disables framing protection: an X-Frame-Options header set to a value other than DENY / SAMEORIGIN, or a Content-Security-Policy whose frame-ancestors directive allows the * wildcard.

Rationale

Framing protection tells the browser whether the page may be embedded in an <iframe>. When X-Frame-Options is left permissive (ALLOWALL, or an ALLOW-FROM value that modern browsers ignore) or the CSP frame-ancestors directive allows any origin, an attacker can embed the page in a transparent frame over decoy content and trick the user into clicking on it (clickjacking / UI redressing).

// VULNERABLE
context.Response.Headers.Append("X-Frame-Options", "ALLOWALL");
context.Response.Headers.Append("Content-Security-Policy", "frame-ancestors *");
This detector only flags an explicitly permissive value. The separate case of no framing header being set anywhere in the application is not reported here, because it cannot be decided reliably from a single file.

Remediation

Set X-Frame-Options to DENY (or SAMEORIGIN when same-origin framing is required), and/or a restrictive CSP frame-ancestors.

context.Response.Headers.Append("X-Frame-Options", "DENY");
context.Response.Headers.Append("Content-Security-Policy", "frame-ancestors 'none'");

References