<commit_before>========================
Clickjacking Protection
========================

.. module:: django.middleware.clickjacking
   :synopsis: Protects against Clickjacking

The clickjacking middleware and decorators provide easy-to-use protection
against `clickjacking`_.  This type of attack occurs when a malicious site
tricks a user into clicking on a concealed element of another site which they
have loaded in a hidden frame or iframe.

.. _clickjacking: http://en.wikipedia.org/wiki/Clickjacking

An example of clickjacking
==========================

Suppose an online store has a page where a logged in user can click "Buy Now" to
purchase an item. A user has chosen to stay logged into the store all the time
for convenience. An attacker site might create an "I Like Ponies" button on one
of their own pages, and load the store's page in a transparent iframe such that
the "Buy Now" button is invisibly overlaid on the "I Like Ponies" button. If the
user visits the attacker's site, clicking "I Like Ponies" will cause an
inadvertent click on the "Buy Now" button and an unknowing purchase of the item.

.. _clickjacking-prevention:

Preventing clickjacking
=======================

Modern browsers honor the `X-Frame-Options`_ HTTP header that indicates whether
or not a resource is allowed to load within a frame or iframe. If the response
contains the header with a value of ``SAMEORIGIN`` then the browser will only
load the resource in a frame if the request originated from the same site. If
the header is set to ``DENY`` then the browser will block the resource from
loading in a frame no matter which site made the request.

.. _X-Frame-Options: https://developer.mozilla.org/en/The_X-FRAME-OPTIONS_response_header

Django provides a few simple ways to include this header in responses from your
site:

1. A simple middleware that sets the header in all responses.

2. A set of view decorators that can be used to override the middleware or to
   only set the header for certain views.

How to use it
=============

Setting X-Frame-Options for all responses
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<commit_msg>Fixed #24896 -- Doc'd clickjacking protection doesn't overwrite X-Frame-Options header.<commit_after>========================
Clickjacking Protection
========================

.. module:: django.middleware.clickjacking
   :synopsis: Protects against Clickjacking

The clickjacking middleware and decorators provide easy-to-use protection
against `clickjacking`_.  This type of attack occurs when a malicious site
tricks a user into clicking on a concealed element of another site which they
have loaded in a hidden frame or iframe.

.. _clickjacking: http://en.wikipedia.org/wiki/Clickjacking

An example of clickjacking
==========================

Suppose an online store has a page where a logged in user can click "Buy Now" to
purchase an item. A user has chosen to stay logged into the store all the time
for convenience. An attacker site might create an "I Like Ponies" button on one
of their own pages, and load the store's page in a transparent iframe such that
the "Buy Now" button is invisibly overlaid on the "I Like Ponies" button. If the
user visits the attacker's site, clicking "I Like Ponies" will cause an
inadvertent click on the "Buy Now" button and an unknowing purchase of the item.

.. _clickjacking-prevention:

Preventing clickjacking
=======================

Modern browsers honor the `X-Frame-Options`_ HTTP header that indicates whether
or not a resource is allowed to load within a frame or iframe. If the response
contains the header with a value of ``SAMEORIGIN`` then the browser will only
load the resource in a frame if the request originated from the same site. If
the header is set to ``DENY`` then the browser will block the resource from
loading in a frame no matter which site made the request.

.. _X-Frame-Options: https://developer.mozilla.org/en/The_X-FRAME-OPTIONS_response_header

Django provides a few simple ways to include this header in responses from your
site:

1. A simple middleware that sets the header in all responses.

2. A set of view decorators that can be used to override the middleware or to
   only set the header for certain views.

The ``X-Frame-Options`` HTTP header will only be set by the middleware or view
decorators if it is not already present in the response.

How to use it
=============

Setting X-Frame-Options for all responses
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
{'fraction_non_alphanumeric': 0.10967165512620058, 'fraction_numerical': 0.0020102747375474648, 'mean_word_length': 4.6397984886649875, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '1748126', 'n_tokens_mistral': 1187, 'n_tokens_neox': 1114, 'n_words': 633}