Click-Jacking Protection
Checks if your site is allowed to be IFRAMEd by another site and thus would be susceptible to click-jacking.
How to fix this health check
This health check can be fixed by adding a header before the response is started.
Preferable you use a security library like NWebSec.
Adding Click-Jacking Protection using NWebSec
If you take a NuGet dependency on NWebsec.AspNetCore.Middleware/, you can use third extension methods on IApplicationBuilder
.
public class Startup
{
public void Configure(IApplicationBuilder app)
{
app.UseXfo(options => options.SameOrigin());
...
}
}
Adding Click-Jacking Protection using manual middleware
Avoid third-party library dependencies by using custom middleware added to the request pipeline.
public class Startup
{
public void Configure(IApplicationBuilder app)
{
app.Use(async (context, next) =>
{
context.Response.Headers.Add("X-Frame-Options", "SAMEORIGIN");
await next();
});
...
}
}