MDonaghy648396 (Community Member) asked a question.
Which header is CWE ID 693 referring to?
Hi,
Our dynamic scan raised an issue with Protection Mechanism Failure (CWE ID 693) but the report does not indicate which headers to add. I see from other questions here that this is most likely to be flagging the header X-Frame-Options is missing. Previous scans list suggested security headers to add - why does the report not do it in this case?
Also, our applications use frames so we cannot add this header. How can we configure the scan to not flag this?
Thanks,
Martin
.png){kind=logo}
Hi @MDonaghy648396 (Community Member) ,
We strongly recommend against using the Detailed Report when remediating flaws. It does not have all the necessary details to remediate flaws (such as request and response details for Veracode Dynamic Analysis) nor does it have facilities to propose a mitigation.
Please use the online Veracode Platform ( https://analysiscenter.veracode.com ) when remediating flaws, if you do not have an account please contact your security team.
If your application uses frames you may consider setting X-Frame-Options to 'SAMEORIGIN'. For more information please see the MDN documentation: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options .
You should also consider whitelisting domains using a Content Security Policy. For more information please see the MDN documentation: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-src .
Please let me know if you have any remaining questions or concerns.
Thank you,
Boy Baukema