X-Frame-Options alert on 403 and 404 pages

[Cash Williams]

Running against a Drupal site, I'm seeing alerts for "X-Frame-Options Header Not Set". Looking at these pages, these are all 403 and 404 pages that are returned via Apache using .htaccess.

Does it make sense to alert on these? 

If No, should ZAP not report on them?

If Yes, what am I missing as I'm not sure how lacking this header would be used in an attack.

[Simon Bennetts]

I agree, it doesnt make much sence :)
I've raised an issue for this: https://code.google.com/p/zaproxy/issues/detail?id=1600

Anyone disagree?

Cheers,

Simon

[kingthorin+owaspzap]

I think it would depend on the content of the 403 and 404, which we can't really predict ahead of time.

If it's a custom 403 or 404 there could still be something worth clickjacking or carrying out another type of framing attack on.

I guess this is also something we could handle via threshold. Medium/Low ignore various error response types, High/Insane then alert on them.....

[Simon Bennetts]

+1