Content-Security-Policy (CSP)

wikipedia:Content Security Policy standard and HTTP header (Content-Security-Policy:)

• XSS
• Clickjacking

Content-Security-Policy: frame-ancestors 'none'
Content-Security-Policy: frame-ancestors 'self'
Content-Security-Policy: frame-ancestors https://trusted.example.com

frame-ancestors

The Content-Security-Policy HTTP header has a frame-ancestors directive which obsoletes X-Frame-Options for supporting browsers.

Related

• HTTP Strict Transport Security (HSTS)

See also

• HTTP Headers: Authorization:, X-Frame-Options, Content-Security-Policy, Cache-Control, Terraform: drop_invalid_header_fields
• Web application security, Web Application Security Consortium (WASC), Clickjacking, XSS