描述:
A Cross-Frame Scripting (XFS) vulnerability can allow an attacker to load the vulnerable application inside an HTML iframe tag on a malicious page. The attacker could use this weakness to devise a Clickjacking attack to conduct phishing, frame sniffing,social engineering or Cross-Site Request Forgery attacks.
解决方案
nginx:
在server中添加add_header X-Frame-Options SAMEORIGIN;;
例如:
server {
add_header X-Frame-Options SAMEORIGIN;
}