---
name: "clickjacking-x-frame-options-guard"
description: "Prevent clickjacking attacks using X-Frame-Options and CSP frame-ancestors."
metadata:
  author: "OWASP"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "prevent clickjacking attack"
  - "configure x-frame-options"
  - "set csp frame-ancestors"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Clickjacking Mitigation with Frame-Ancestors

Blocks unauthorized iframe framing of sensitive web pages: configuring X-Frame-Options: DENY / SAMEORIGIN and CSP frame-ancestors 'self' directives across reverse proxies and application frameworks.

## When to Invoke
Invoke this skill whenever you need to:
- prevent clickjacking attack
- configure x-frame-options
- set csp frame-ancestors

## Execution SOP & Rules
1. Set header X-Frame-Options: DENY for pages that should never be framed.
2. Configure Content-Security-Policy: frame-ancestors 'self' or allowed partner domains.
3. Apply framing protections across all authenticated routes and settings pages.
4. Verify headers are present on error responses (404, 500) as well as standard 200 responses.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.