Actually Clickjack protection secures your Visualforce pages against user interface redress attacks.
Salesforce provide 2 ways to apply this protection:
- By enabling a global setting
- Keeping salesforce default header in your page that is
So Clickjack protection is implemented by salesforce by adding a X-Frame-Options: SAMEORIGIN header to Visualforce pages. When headers are suppressed by setting showHeader="false" on a page, this header isn’t added to the page, and clickjack protection is disabled.
But what if you want this protection to be enabled also you don't want to show header as well, for this salesforce has provided global setting:
Enable clickjack protection for customer Visualforce pages with headers disabled
under Setup | Security Controls | Session Settings
Enabling clickjack protection for Visualforce pages has some side effects. When this header is activated, only pages served from the Visualforce domain can wrap Visualforce pages in an , or otherwise embed Visualforce pages.
You have two options for handling existing framed Visualforce pages.
- Discontinue displaying these pages within a frame or . This
solution is recommended.
- Don’t enable clickjack protection for your Visualforce pages. This
option allows you to continue framing Visualforce pages, but the
pages are vulnerable to clickjack attacks. This option isn’t