X-Frame-Options header on error response

问题:

I found an interesting bug report related to X-Frame-Options header. But I dont understand how this can be security problem.

Following code is given as proof of vulnerability:

require 'net/http'  
require 'uri'  
uri = URI.parse("https://play.google.com/#{"a" * 10000}")  
@r = Net::HTTP.get_response uri  
ret = @r.each_header {|x| puts x}  
if ret["x-frame-options"]  
  puts ret["x-frame-options"]  
else  
  puts "Missing x-frame-options!"  
end 

But it is trying to access an invalid URL (https://play.google.com/aaaaaaaaa...) and returns an error page. In the response, x-frame-options header is missing. I don't understand how this can be a security vulnerability (since it is a invalid page and its a error response)? How this can be used for clickjacking? Why is it important for the error response also should have this header set?

回答1:

You can add following line to .htaccess

Header always unset X-Frame-Options