X-frame-Options Http 响应 Header 不起作用

Question

I am trying to add X-Frame-Options response header in my app. So I am configuring this in my express server. I have used helmet as an npm package to configure and this is the code which I have used

const express = require("express");
const helmet = require("helmet");

const app = express();

app.use(
  helmet.frameguard({
    action: "SAMEORIGIN",
  })
);

But still I am not able to see the header X-Frame-Options: SAMEORIGIN in the browser.

Can anyone tell what I am doing wrong or any better way to solve this.

Answer 1

Helmet By default set following headers

Content-Security-Policy: default-src 'self';base-uri 'self';block-all-mixed-content;font-src 'self' https: data:;form-action 'self';frame-ancestors 'self';img-src 'self' data:;object-src 'none';script-src 'self';script-src-attr 'none';style-src 'self' https: 'unsafe-inline';upgrade-insecure-requests
Cross-Origin-Embedder-Policy: require-corp
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Expect-CT: max-age=0
Origin-Agent-Cluster: ?1
Referrer-Policy: no-referrer
Strict-Transport-Security: max-age=15552000; includeSubDomains
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-XSS-Protection: 0

You can read more into there documentation for default headers

So for header X-Frame-Options: SAMEORIGIN you need to in the following manner

const express = require('express');
const helmet = require("helmet");

const app = express();
app.use(helmet());

This will set the default headers and X-Frame-Options: SAMEORIGIN