1

I am getting " X-Frame-Options Header Not Set" issue in salesforce how I can solve this issue, I have attach a image please take a look on that image.

enter image description here

Improve this question

2 Answers 2

Reset to default
1

I think that Salesforce abstract that from you by what they call the "Clickjacking protection", which deals with permission on how to frame your page. There's more info here: https://help.salesforce.com/apex/HTViewHelpDoc?id=siteforce_clickjacking_enable.htm&language=en_US

I would suggest enabling it and running the ZAP scan again.

Improve this answer
0

See Summer 15 release notes

Clickjack protection secures your Visualforce pages against user interface redress attacks. You can enable clickjack protection for Visualforce pages that suppress the standard header. The setting is global to your organization and applies to all your Visualforce pages.

To enable clickjack protection for Visualforce pages that suppress the standard header, select Enable clickjack protection for customer Visualforce pages with headers disabled under Setup | Security Controls | Session Settings.

Clickjack protection is implemented by adding a X-Frame-Options: SAMEORIGIN header to Visualforce pages. When headers are suppressed by setting showHeader="false" on a page, this header isn’t added to the page, and clickjack protection is disabled.

Improve this answer
1
  • 1
    I don't see any reason to downvote this post.It's enough searched and provides a valuable information. Expecting from the downvoters to be brave and provide a thoughtful reason.I'd be glad to hear you.
    – Mr.Frodo
    Jun 11, 2016 at 5:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .