“X-Frame-Options”

Resolved timholz
(@timholz)

5 months, 3 weeks ago
Hi – File Security > Frames > «Enable this to stop other sites from displaying your content in a frame or iframe.» X-Frame-Options are a part of content-security-header (frame-ancestors). And your plugin is not really adding the X-Frame-Options Header but rather a Content-Security-Policy-Header.

This is a bit confusing and in my case enabling this option overrides my own csp-rules sent with wordpress send_headers function. I disabled the option for my own csp takes care of that. It would be helpful, if this option was described more clearly.

regards theo
- This topic was modified 5 months, 3 weeks ago by timholz.

Viewing 4 replies - 1 through 4 (of 4 total)

Plugin Support hjogiupdraftplus
(@hjogiupdraftplus)

5 months, 3 weeks ago
Hi @timholz,

File security > Frames > Enable iFrame protection: should add the X-Frame-Options as per the send_frame_options_header

https://developer.ww.wp.xz.cn/reference/functions/send_frame_options_header/
```
header( 'X-Frame-Options: SAMEORIGIN' );
```
But it seems the WP 6.4+ adds the content security policy also, which we need to check. But it seems WordPress adds that. AIOS uses send_frame_options_header

Content-Security-Policy: frame-ancestors 'self'

Regards
Thread Starter timholz
(@timholz)

5 months, 3 weeks ago
Hello @hjogiupdraftplus – thanks for the message. I cannot confirm that WP 6.4+ automatically sends a CSP policy. That would be very arbitrary, for how could WP possibly know the specific conditions to consider for a good CSP. I send my custom CSP with add_action('send_headers', 'add_csp_header',10,1); regards theo
- This reply was modified 5 months, 3 weeks ago by timholz.
Plugin Support hjogiupdraftplus
(@hjogiupdraftplus)

5 months, 3 weeks ago

Hi @timholz,

WP 6.9, its functions.php send_frame_options_header code, as per the screenshot below, has the

Content-Security-Policy: frame-ancestors 'self'

https://snipboard.io/wDBcoE.jpg

Regards
Thread Starter timholz
(@timholz)

5 months, 2 weeks ago
Hi @hjogiupdraftplus – thanks. Emphasizing !headers_sent()! I hope no one stumbles over that. Quite a crude approach to CSP. regards theo
- This reply was modified 5 months, 2 weeks ago by timholz.

Viewing 4 replies - 1 through 4 (of 4 total)

You must be logged in to reply to this topic.