Search code examples
securityowaspx-frame-optionsclickjacking

Is it necessary to set X-Frame-Options for 404 Not Found pages


In Clickjacking Defense Cheat Sheet OWASP recommends to set the X-Frame-Options header for all responses containing HTML content, but I am not sure if it is necessary to set this header also for 404 Not Found pages which contains only this HTML content (without any links):

<html><head><title>Error</title></head><body>404 - Not Found</body></html>


Solution

  • Unless framing is required, I would always advise setting X-FRAME-OPTIONS: Deny and also the new, standard Content Security Policy frame-ancestors directive.

    The reason is that there as other attacks such as Cross Site History Manipulation (XSHM) and Path-Relative Stylesheet Import (PRSSI) that rely on the victim site being framed.

    That said, if your 404 page has "nothing to Clickjack" there is little benefit in preventing framing here in order to prevent Clickjacking. PRSSI also requires that the content is dynamic and XSHM shouldn't really be affected in terms of timing attacks as the target page still has to load before the browser knows not to display it in a frame.

    Therefore,

    Is it necessary to set X-Frame-Options for 404 Not Found pages

    No.