CyberCertPrepWeb App FundamentalsBrowser SecurityEASYFree question
A developer wants to prevent their authentication page from being framed by any site, including their own subdomains. Which Content Security Policy directive achieves this precisely?
- A.Content-Security-Policy: default-src 'none'
- B.X-Frame-Options: SAMEORIGIN blocks all framing including subdomains
- C.Content-Security-Policy: sandbox - this blocks framing
- D.Content-Security-Policy: frame-ancestors 'none' - this prevents the page from being embedded in any frame, iframe, or object element from any origin, including same-origin and subdomain requests. X-Frame-Options: DENY provides the same protection but frame-ancestors is more flexible and overrides X-Frame-Options in browsers that support CSP Level 2+
Why D is correct
CSP frame-ancestors directive controls which origins can embed the page. 'none' allows no framing from anywhere (same-origin included). 'self' allows same-origin framing. Specific origins can be listed. frame-ancestors supersedes X-Frame-Options in browsers that support it - they should both be set for maximum compatibility. X-Frame-Options: DENY and frame-ancestors: 'none' are equivalent but X-Frame-Options cannot express complex origin rules (like allowing specific domains), while frame-ancestors can.
Know someone studying for Web App Fundamentals? Send them this one.