Exam 350-201 topic 1 question 83 discussion

ChatGPT: The X-Frame-Options header is used to control whether a browser should be allowed to render a page in a <frame>, <iframe>, <embed>, or <object> tag. This header helps protect against clickjacking attacks, where a malicious site could try to trick users into interacting with content on another page (e.g., by hiding a button or link beneath an invisible iframe).

Rendering permissions is the key word here, which would be related to X-Frame-Options

The browser page rendering permissions are displayed in the X-Frame-Options HTTP response header. This header is used to control whether a browser should be allowed to render a page in a <frame>, <iframe>, <embed>, or <object>. Sites can use this to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites. The options are "DENY", "SAMEORIGIN", or

The browser page rendering permissions are displayed in the X-Frame-Options header. This header is used to indicate whether or not a browser should be allowed to render a page in a frame, iframe, or object tag. It can be set to three different values: DENY, SAMEORIGIN, and ALLOW-FROM. DENY means the page cannot be rendered in a frame at all, SAMEORIGIN means the page can only be rendered in a frame from the same origin, and ALLOW-FROM allows the page to be rendered in a frame from a specific URI. - ChatGPT

A. x-frame-options The x-frame-options is a HTTP response header that is used to indicate whether a browser should be allowed to render a page in a frame, iframe or object. The x-frame-options header value can be set to one of three values: "deny", "sameorigin" or "allow-from <uri>".

A. X-Frame-Options The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame>, <iframe>, <embed> or <object>. Sites can use this to avoid click-jacking attacks, by ensuring that their content is not embedded into other sites. The added security is provided only if the user accessing the document is using a browser that supports X-Frame-Options.

The answer is C It's refer to the rendering permission here. There are two possible directives for X-Frame-Options: X-Frame-Options: DENY X-Frame-Options: SAMEORIGIN

I think A is corect https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options#browser_compatibility