Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →thedaviddias/x-frame-options
Use when reviewing HTTP response headers for clickjacking protection on any web application with authenticated user actions.
Passed 18 of 22 test cases with the skill, and 17 of 22 without it.
2 fixed16 passed either way3 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
This benchmark measured an earlier version of the skill.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
We are using the `x-frame-options` middleware in our Express application by calling `app.use(xFrameOptions())` without any arguments. A developer claims this will allow framing from the same origin. Is this correct, and what header value is actually set?
| Checked | Without skill | With skill |
|---|---|---|
| States that the developer is incorrect | Missed | Passed |
| Specifies that the default header value set is 'Deny' | Missed | Passed |
The instructions your model reads when the skill loads.
Without framing protection, an attacker can embed your banking login page in a transparent iframe on a malicious site and trick users into clicking buttons they cannot see — transferring money, changing settings, or leaking credentials.
X-Frame-Options: DENY to prevent all framing, or SAMEORIGIN to allow framing only from your own domainALLOWFROM is obsolete and unsupported in modern browsers — use CSP frame-ancestors insteadContent-Security-Policy: frame-ancestors 'none' — prefer CSP for new sitesCheck whether the server sends an X-Frame-Options header (DENY or SAMEORIGIN) or a Content-Security-Policy header with frame-ancestors directive to prevent clickjacking.
Add X-Frame-Options: DENY to all responses if the site does not need to be embedded anywhere. If legitimate framing is needed on the same origin, use SAMEORIGIN. For fine-grained control, use CSP frame-ancestors instead.
Explain what a clickjacking attack is, how X-Frame-Options and CSP frame-ancestors prevent it, and the difference between DENY and SAMEORIGIN values.
Review server config, headers, forms, and integration points related to Set an X-Frame-Options header. Flag exact responses, cookies, or browser behaviors that violate the rule, and verify them against the effective production-like response.
For full implementation details, code examples, and framework-specific guidance,
see references/rule.md.
Rule page: https://frontendchecklist.io/rules/security/x-frame-options
test cases passed, vs 17 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.