Troubleshooting
Problem
In Integration Server, it is possible to load the application inside of a frame because of the insecure design of frames in html an attacker can perform UI redressing attacks to control the location of the content on the victims screen.
This vulnerability enables a "clickjacking" attack, in which the attacker's page overlays the target application's interface with a different interface provided by the attacker. By inducing victim users to perform actions such as mouse clicks and keystrokes, the attacker could possibly cause them to unwittingly carry out actions within the application that is being targeted. This technique allows the attacker to circumvent defenses against cross-site request forgery, and may result in unauthorized actions.
To effectively prevent framing attacks, the application should return a response header with the name X-Frame-Options and the value DENY to prevent framing altogether, or the value SAMEORIGIN to allow framing only by pages on the same origin as the response itself.
Is that possible to set this parameter in http response header of Integration Server page?
Document Location
Worldwide
Log InLog in to view more of this document
Was this topic helpful?
Document Information
Modified date:
20 March 2025
UID
ibm17220938