Cis Apache 5.14

---
name: cis-apache-5.14
description: "Ensure Browser Framing Is Restricted"
category: cis-apache
version: "3.6.0"
author: cyberstrike-official
tags: [cis, apache, linux, features, options]
cis_id: "5.14"
cis_benchmark: "CIS Apache HTTP Server 2.2 Benchmark v3.6.0"
tech_stack: [linux, apache]
cwe_ids: []
chains_with: []
prerequisites: []
severity_boost: {}
---

# Ensure Browser Framing Is Restricted

## Description

The Header directive allows server HTTP response headers to be added, replaced, or merged. Use the directive to add a server HTTP response header to tell browsers to restrict all the web pages from being framed by other web sites.

## Rationale

Using iframes and regular web frames to embed malicious content along with expected web content has been a favored attack vector for attacking web clients for a long time. This can happen when the attacker lures the victim to a malicious web site, which uses frames to include the expected content from the legitimate site. The attack can also be performed via XSS (either reflected, DOM or stored XSS) to add the malicious content to the legitimate web site. To combat this vector, an HTTP Response header, X-Frame-Options, has been introduced that allows a server to specify whether a web page may be loaded in any frame (DENY) or only those frames that share the page's origin (SAMEORIGIN).

## Audit Procedure

Perform the following steps to determine if the recommended state is implemented:

Ensure a `Header` directive for X-Frame-Options is present in the Apache configuration and has the condition `always`, an action of `append`, and a value of `SAMEORIGIN`, as shown below:

```
# grep -i X-Frame-Options $APACHE_PREFIX/conf/httpd.conf
Header always append X-Frame-Options SAMEORIGIN
```

## Remediation

Perform the following to implement the recommended state:

Add or modify the `Header` directive for the `X-Frame-Options` header in the Apache configuration to have the condition `always`, an action of `append`, and a value of `SAMEORIGIN`, as shown below.

```
Header always append X-Frame-Options SAMEORIGIN
```

## Default Value

The `X-Frame-Options` HTTP response header is not generated by default

## References

1. http://httpd.apache.org/docs/2.2/mod/mod_headers.html#header
2. https://developer.mozilla.org/en/The_X-FRAME-OPTIONS_response_header
3. http://blogs.msdn.com/b/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx

## CIS Controls

**Version 6**

18 Application Software Security
Application Software Security

**Version 7**

5.1 Establish Secure Configurations
Maintain documented, standard security configuration standards for all authorized operating systems and software.

## Profile

Level 2 | Scored