Security Scan Vulnerability - "Cross Site Scripting / Cross Frame Scripting"

Security Scan Reports reveal "Cross-Site/Cross Frame Request Forgery" vulnerability.

The web application doesn't or can't sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution. This attack technique takes advantage of browser functionality to steal data from a website. Web applications that allow their content to be hosted in a cross-domain IFRAME may be vulnerable to this attack.

Administrators can mitigate this by configuring IIS to send an HTTP response header that prevents content from being hosted in a cross-domain IFRAME.

The X-frame Options headercan be used to control whether a page can be placed in an IFRAME. Because the attack-technique relies on being able to place the victim site in an IFRAME, a web application can protect itself by sending an appropriate X-Frame-Options header.

To add an X-Frame Options header to all responses for your sites, please follow one of the two options below