Clickjacking protection removed or weakened on the HTTP response

ID

vbnet.misconfiguration.missing_clickjacking_protection

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Misconfiguration

Language

VB.NET

Description

Server-side code removes the X-Frame-Options response header, or sets it to a value other than DENY or SAMEORIGIN (e.g. ALLOWALL, ALLOW-FROM with a wildcard). This lets the page be framed by arbitrary sites, exposing users to clickjacking (UI redressing). Keep X-Frame-Options set to DENY or SAMEORIGIN, or send a Content-Security-Policy with a restrictive frame-ancestors directive instead.

Rationale

Server-side code removes the X-Frame-Options response header, or sets it to a value other than DENY or SAMEORIGIN (e.g. ALLOWALL, ALLOW-FROM with a wildcard). This lets the page be framed by arbitrary sites, exposing users to clickjacking (UI redressing). Keep X-Frame-Options set to DENY or SAMEORIGIN, or send a Content-Security-Policy with a restrictive frame-ancestors directive instead.

The following code illustrates a vulnerable pattern detected by this rule:

Public Sub StripFrameOptions()
    ' VULNERABLE: Clickjacking protection removed or weakened on the HTTP response
    Response.Headers.Remove("X-Frame-Options")
End Sub

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References