Skip to content
FrontendHaltFrontendHalt
Security·Intermediate·Conceptual·1 min read

How do X-Frame-Options and CSP frame-ancestors relate?

Short interview answer

Both control whether the page can be embedded in a frame, which is the primary clickjacking defense. frame-ancestors is the modern, more expressive mechanism (it supports multiple origins and is part of CSP); X-Frame-Options is the older header kept for legacy browser support.

Key takeaway

Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.

← Back to Content Security Policy and security headers

Related questions