we were working on a new site development where we have to handle the cross frame scripting attack so that a intruder could not be able to frame our site into his/her iFrame. we thought to set “X-Frame-Options:” to “Deny” . Post this change our external site was woring fine without any issue and site passed the security scan but we started facing issue with content editor/experience editor where the browser prevent to load the contents/components in sitecore internal iframe. After this issue we realise to change X-Frame-Options from DENY to SAMEORIGIN which resolved the issue.
Now we again had a challange with some older version of browser. Since the “X-Frame-Options” was introduced in 2009, this header is not compatible with old browser. So every user that doesn’t have an updated browser could be the victim of clickjacking attack.
We resolved this issue through client side protection (java script): Frame Busting. we have added the below code in to the sitecore Layout so that it was dynamically injected in each page of the site.
// This is Javascript to prevent Cross Frame scripting in old browsers
public string FrameBustingScript = “<style id=\”antiClickjack\”>body{display:none !im-portant;}</style>if(self === top){var antiClickjack = docu-ment.getElementById(\”antiClickjack\”);antiClickjack.parentNode.removeChild(antiClickjack);} else {top.location =self.location;}”;
