Skip to main content
This topic is closed to new replies. Start a new post to keep the conversation going.
Steve SommersCorrect answer
Legend
April 15, 2015

Clickjacking is a client side event so "ColdFusion (Java) interpretation of page IFRAME content occurring independently of IIS web server's interpretation" would not be a issue -- assuming any of this is going on, which I cannot fathom how it would be. You can set the X-Frame-Options header value in either IIS or your CF application using CFHeader. If both IIS and CF sets the value, I'm fairly certain the client will receive two header entries and while ugly, as long as they don't conflict with each other I think you're fine. Does that answer your question?

View reply

5 replies

Steve SommersCorrect answer
Legend
April 15, 2015

Clickjacking is a client side event so "ColdFusion (Java) interpretation of page IFRAME content occurring independently of IIS web server's interpretation" would not be a issue -- assuming any of this is going on, which I cannot fathom how it would be. You can set the X-Frame-Options header value in either IIS or your CF application using CFHeader. If both IIS and CF sets the value, I'm fairly certain the client will receive two header entries and while ugly, as long as they don't conflict with each other I think you're fine. Does that answer your question?

Translate
GuyMcMickleAuthor
Inspiring
April 15, 2015

Is my understanding of your response correct?  Web site sends a directive to the client (browser) declaring client should not accept content into IFRAME from anywhere else than the host site?  It is up to the client (browser) to handle rejecting any "foreign" (URL path) information within the IFRAME?

Translate
Steve Sommers
Legend
April 15, 2015

Correct.

Translate
Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices