security.misconfiguration

Do not derive anti-framing headers from request input

Framing and CSP headers should not be set from request-controlled values.

#Metadata

#Why it matters

Request-controlled anti-framing headers weaken protections against clickjacking and UI redress attacks.

#Remediation

Set framing and CSP headers from fixed server policy instead of request data.

#Repository path

The generated metadata points to critiq-rules/libs/rules/catalog/rules/typescript/ts.security.ui-redress.rule.yaml.