The clickjacking middleware and decorators provide easy-to-use protection\nagainst clickjacking. This type of attack occurs when a malicious site\ntricks a user into clicking on a concealed element of another site which they\nhave loaded in a hidden frame or iframe.
\nSuppose an online store has a page where a logged in user can click «Buy Now» to\npurchase an item. A user has chosen to stay logged into the store all the time\nfor convenience. An attacker site might create an «I Like Ponies» button on one\nof their own pages, and load the store’s page in a transparent iframe such that\nthe «Buy Now» button is invisibly overlaid on the «I Like Ponies» button. If the\nuser visits the attacker’s site, clicking «I Like Ponies» will cause an\ninadvertent click on the «Buy Now» button and an unknowing purchase of the item.
\nModern browsers honor the X-Frame-Options HTTP header that indicates whether\nor not a resource is allowed to load within a frame or iframe. If the response\ncontains the header with a value of SAMEORIGIN then the browser will only\nload the resource in a frame if the request originated from the same site. If\nthe header is set to DENY then the browser will block the resource from\nloading in a frame no matter which site made the request.
Django provides a few simple ways to include this header in responses from your\nsite:
\nA simple middleware that sets the header in all responses.
A set of view decorators that can be used to override the middleware or to\nonly set the header for certain views.
The X-Frame-Options HTTP header will only be set by the middleware or view\ndecorators if it is not already present in the response.
X-Frame-Options for all responsesLink to this heading#To set the same X-Frame-Options value for all responses in your site, put\n'django.middleware.clickjacking.XFrameOptionsMiddleware' to\nMIDDLEWARE:
MIDDLEWARE = [\n ...\n 'django.middleware.clickjacking.XFrameOptionsMiddleware',\n ...\n]\nThis middleware is enabled in the settings file generated by\nstartproject.
By default, the middleware will set the X-Frame-Options header to\nSAMEORIGIN for every outgoing HttpResponse. If you want DENY\ninstead, set the X_FRAME_OPTIONS setting:
X_FRAME_OPTIONS = 'DENY'\nWhen using the middleware there may be some views where you do not want the\nX-Frame-Options header set. For those cases, you can use a view decorator\nthat tells the middleware not to set the header:
from django.http import HttpResponse\nfrom django.views.decorators.clickjacking import xframe_options_exempt\n\n@xframe_options_exempt\ndef ok_to_load_in_a_frame(request):\n return HttpResponse("This page is safe to load in a frame on any site.")\nX-Frame-Options per viewLink to this heading#To set the X-Frame-Options header on a per view basis, Django provides these\ndecorators:
from django.http import HttpResponse\nfrom django.views.decorators.clickjacking import xframe_options_deny\nfrom django.views.decorators.clickjacking import xframe_options_sameorigin\n\n@xframe_options_deny\ndef view_one(request):\n return HttpResponse("I won't display in any frame!")\n\n@xframe_options_sameorigin\ndef view_two(request):\n return HttpResponse("Display in a frame if it's from the same origin as me.")\nNote that you can use the decorators in conjunction with the middleware. Use of\na decorator overrides the middleware.
\nThe X-Frame-Options header will only protect against clickjacking in a\nmodern browser. Older browsers will quietly ignore the header and need other\nclickjacking prevention techniques.
X-Frame-OptionsLink to this heading#Internet Explorer 8+
Firefox 3.6.9+
Opera 10.5+
Safari 4+
Chrome 4.1+
A complete list of browsers supporting X-Frame-Options.