I have an Angular-14 application.

How do I deal with this issue?:

Missing X-Frame options - X-Frame-Options header is missing or not set to DENY or SAMEORIGIN. Without an X-Frame-Options response header, clickjacking may be possible.

Thanks

CodePudding user response：

This is more of a question around IIS. Mircosoft has the following documentation of adding custom http response headers. On more Information what the X-Frame-Options header is, you can refer to the mozilla documentation:

The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame>, <iframe>, <embed> or <object>. Sites can use this to avoid click-jacking attacks, by ensuring that their content is not embedded into other sites.

I would recommend setting the header to DENY, if you don't use any of the mentioned tags. If you do the "safe" option for production, that shouldn't break anything in a simple environment is SAMEORIGIN. Although this also depends on your application.