RCraig521917 (Community Member) asked a question.
I have been addressing flaws for a website I am a consultant for. Protection Mechanism Failure (CWE ID 693) previously came up for the site as a whole. I addressed it by adding "X-Frame-Options: SAMEORIGIN" as a response header and the flaw was fixed. In our latest report, this same flaw was found for a piece of code within my codebase:
/wp-content/plugins/advanced-flat-rate-shipping-method-for-woocommerce/public/
Any thoughts on why this came up for just this one piece of plugin code? My codebase has a lot of plugins and this is the only one reported. Could it be a false positive if it hasn't come up before? This wasn't a new plugin added and I am trying to figure out how to mitigate this.
Thanks for the help!
.png){kind=logo}
Hi @RCraig521917 (Community Member),
Findings related to HTTP headers (e.g. `X-Frame-Options`) are only shown once to avoid potentially countless flaws reported on the same thing. This means that, even though it is only shown for one of the plugins, it may still also have been detected for another plugin. Usually, the recommended approach is to enable these security headers at a central location and the exact page where it's being reported is thus less relevant.
Please make sure that all of your plugins set the `X-Frame-Options` header appropriately. This should make the finding ultimately disappear.
Thank you,
Florian Walter
Thank you Florian! That helps a lot. I will work on that.