Skip to main content
GuyMcMickle
Inspiring
Apr 13, 2015 7:26 PM UTC
Answered

ClickJacking With IIS

Are ColdFusion's clickjacking filter options (Clickjacking issue - adding multiple url patterns in a single filter mapping) needed if using Internet Information Services' (IIS) HTTP Response Header option setting X-Frame-Options?  Is ColdFusion (Java) interpretation of page IFRAME content occurring independently of IIS web server's interpretation?

    This topic is closed to new replies. Start a new post to keep the conversation going.
    Steve SommersCorrect answer
    Legend
    Apr 15, 2015 5:04 PM UTC

    Clickjacking is a client side event so "ColdFusion (Java) interpretation of page IFRAME content occurring independently of IIS web server's interpretation" would not be a issue -- assuming any of this is going on, which I cannot fathom how it would be. You can set the X-Frame-Options header value in either IIS or your CF application using CFHeader. If both IIS and CF sets the value, I'm fairly certain the client will receive two header entries and while ugly, as long as they don't conflict with each other I think you're fine. Does that answer your question?

    View reply

    5 replies

    Steve SommersCorrect answer
    Legend
    Apr 15, 2015 5:04 PM UTC

    Clickjacking is a client side event so "ColdFusion (Java) interpretation of page IFRAME content occurring independently of IIS web server's interpretation" would not be a issue -- assuming any of this is going on, which I cannot fathom how it would be. You can set the X-Frame-Options header value in either IIS or your CF application using CFHeader. If both IIS and CF sets the value, I'm fairly certain the client will receive two header entries and while ugly, as long as they don't conflict with each other I think you're fine. Does that answer your question?

    Translate
    GuyMcMickleAuthor
    Inspiring
    Apr 15, 2015 5:14 PM UTC

    Is my understanding of your response correct?  Web site sends a directive to the client (browser) declaring client should not accept content into IFRAME from anywhere else than the host site?  It is up to the client (browser) to handle rejecting any "foreign" (URL path) information within the IFRAME?

    Translate
    Steve Sommers
    Legend
    Apr 15, 2015 5:47 PM UTC

    Correct.

    Translate
    Terms & ConditionsAccessibility statement
    Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices