10

I want to prevent my website from clickJacking attack. In which file and where to set X-Frame-Options for preventing clickJacking attack.

1

2 Answers 2

23

You have 2 ways:

  • Setup it in a reverse proxy such as Nginx
add_header X-Frame-Options "SAMEORIGIN";
  • Use Laravel middleware Illuminate\Http\Middleware\FrameGuard onto the routes you want to protect.
<?php

namespace Illuminate\Http\Middleware;

use Closure;

class FrameGuard
{
    /**
     * Handle the given request and get the response.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return \Symfony\Component\HttpFoundation\Response
     */
    public function handle($request, Closure $next)
    {
        $response = $next($request);

        $response->headers->set('X-Frame-Options', 'SAMEORIGIN', false);

        return $response;
    }
}
4
  • Hey, I got the same problem. I tried this approach (FrameGuard), but I still get Refused to display ... in a frame because it set 'X-Frame-Options' to 'sameorigin', Missing something?
    – H Mihail
    Sep 22, 2020 at 5:51
  • 1
    @HMihail It sounds like you want to do the opposite of what the OP is trying to do. (Allow an iframe from a different domain instead of preventing it from all but the same domain.) Dec 4, 2020 at 17:23
  • does this works for api routes as well? I have SPA app.
    – mafortis
    Dec 22, 2020 at 3:00
  • 2
    It is useless against JSON routes, only HTML ones, so it would be useful against your only HTML route
    – Shizzen83
    Dec 22, 2020 at 18:34
4

To fix the problem on all your routes :

Add FrameGuard::class, on the protected $middleware in your app/http/Kernel.php

FrameGuard.php by default is set to "SAMEORIGIN", but you can change the second parameter of the following line with "DENY" or "ALLOW-FROM uri" (according to your needs) :

$response->headers->set('X-Frame-Options', 'SAMEORIGIN', false);

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.