RGaruda (Community Member) asked a question.
CWE-693, X-Frame-Options header not supporting in IE
Hi,
In our Dynamic Scan, we got "Protection Mechanism Failure (CWE ID-693)" was reported as a vulnerability. As suggested in many forum's we used X-Frame-Options as solution. But X-Frame-Options is not recognized in IE11 version and getting errors. So, can we use Content Security Policy frame-ancestor for CWE-693 flaw like below syntax or we have any other solution? Please suggest.
Ex: <add name="Content-Security-Policy" value="frame-ancestors my-trusty-site.com;" />
.png){kind=logo}
Hi @RGaruda (Community Member) ,
X-Frame-Options should be fully supported in IE11: https://caniuse.com/#feat=x-frame-options .
Would you be able to share more details about the errors you're getting? Perhaps you are using frames in your application?
If you are not able to share more details publicly you can also schedule a Consultation with a Veracode Application Security Consultant, you can find more on how to do this here: https://help.veracode.com/r/t_schedule_consultation .
Veracode Dynamic Analysis will also accept 'frame-ancestors' from Content Security Policy level 2 as remediation for this flaw category but if your application supports IE 11 users you may still want to include X-Frame-Options as IE 11 does not support CSP level 2: https://caniuse.com/#feat=contentsecuritypolicy2 .
Please let me know if you have any remaining questions or concerns.
Thank you,
Boy Baukema
Hi @Boy, Security Consultant (Veracode) Thanks for your reply, we are using iframes in our application and we are using X-frame-Options like (<add name="X-Frame-Options" value="ALLOW-FROM http://my-trusty-site.com" />). we are getting "This Content can not be displayed in a frame" error. Also tried with CSP frame-ancestors - <add name="Content-Security-Policy" value="frame-ancestors https://my-trusty-site.com;" />, but in my application frame itself not loading with this option in IE and Chrome. Please suggest on any possible solution which will work across IE11/Chrome/Mozilla/Edge browsers.
Hi @RGaruda (Community Member) ,
I'm afraid if you must whitelist a different domain (please check you are not able to use 'samesite'!) then this becomes a bit more difficult.
Unfortunately, IE supports the ALLOW-FROM option for the XFO header, but other browsers don't. And IE does not support CSP2. You will need to do browser detection in the application and provide the correct header based on the browser. You should be able to use something like a result filter ( https://docs.microsoft.com/en-us/aspnet/core/mvc/controllers/filters?view=aspnetcore-2.2 ) to do this.
Please let me know if you have any remaining questions or concerns.
Thank you,
Boy Baukema