X-Frame-options vs CSP 帧-祖先:防止点击劫持(带有被动检查)

2026年9月5日1 次浏览来源:Dev.to阅读原文

正文保留英文原文(机翻易破坏代码与排版),标题/摘要已提供中文

Clickjacking is the attack where a malicious site loads your page in a transparent iframe and tricks the victim into clicking buttons they believe belong to the attacker.

Two mechanisms stop it — and one of them is being deprecated.

The two defenses Mechanism How it works Status X-Frame-Options: DENY / SAMEORIGIN Header: browser refuses to frame the page Legacy, well supported CSP frame-ancestors CSP directive: / / allowlist Modern, more flexible What gets it wrong — explicitly allows framing; instant FAIL.

CSP with — same as ALLOWALL.

Only XFO while adding third-party widgets that need framing (you'll be forced to loosen CSP or drop XFO — do the reverse: keep CSP strict and use allowlists).

Nothing: no XFO + no frame-ancestors = unprotected.

The passive check Send the request and look for both headers: If you see neither (or ALLOWALL), your page is frameable.

My CLI reconpp flags this automatically with a suggested fix: Output shape: Recommendation New systems: CSP only (), no XFO.

Legacy: keep XFO until the CSP is enforceable.

Never ALLOWALL; never frame-ancestors * (even for "trusted" embedders, use the explicit allowlist).

If your site is embedded intentially (payment widgets etc.), document it and keep the allowlist minimal.

More pass/fail/repair items in the full 70+ point checklist — free sample at the store: Store (Pix): https://bryanrafaelbueno.github.io/audit-br-store/ Free sample PDF: https://bryanrafaelbueno.github.io/audit-br-store/sample.pdf

分享