Update: Clickjacking Defense Cheat Sheet

[andrealungh1]

What is missing or needs to be updated?

The documentation mentions that meta tags attempting to apply the X-Frame-Options directive do not work, but it does not mention that the same limitation applies to the frame-ancestors directive of the Content Security Policy (CSP).

How should this be resolved?

Clarify in the documentation that the frame-ancestors CSP directive also does not work when set via a <meta http-equiv="Content-Security-Policy"> tag, and must be delivered through the HTTP response header instead.

[jmanico]

PR away. Thank you.

[mackowski]

@jmanico are you working on this?

[jmanico]

No, but it's a relatively small PR. Do you want to take this on, @andrealungh1 ?

[andrealungh1]

@jmanico of course!

I'll do a PR as soon as i can.