OWASPASVS 5.0 requirement
ASVS-V3.4.6 The web application uses the frame-ancestors directive of the content-security-policy header field for every http response to ensure that…
- Standard
- OWASP ASVS 5.0
- Chapter
- V3 Web Frontend Security
- Section
- V3.4 Browser Security Mechanism Headers
- Level
- L2 (requirement applies from this verification level up)
Requirement
Verify that the web application uses the frame-ancestors directive of the Content-Security-Policy header field for every HTTP response to ensure that it cannot be embedded by default and that embedding of specific resources is allowed only when necessary. Note that the X-Frame-Options header field, although supported by browsers, is obsolete and may not be relied upon.