Do not derive anti-framing headers from request input
Framing and CSP headers should not be set from request-controlled values.
#Metadata
#Why it matters
Request-controlled anti-framing headers weaken protections against clickjacking and UI redress attacks.
#Remediation
Set framing and CSP headers from fixed server policy instead of request data.
#Repository path
The generated metadata points to critiq-rules/libs/rules/catalog/rules/typescript/ts.security.ui-redress.rule.yaml.