Property reference

glide.set_x_frame_options

Sets the X-Frame-Options response header to SAMEORIGIN on UI pages. With the default value of true, browsers can render those pages only in frames from the same origin, helping prevent clickjacking.

Default
true
Type
boolean
Application
Global

Key questions about this property

The answers below summarize the purpose, scope, default effect, and review scenarios for this property.

What does it do? It configures the X-Frame-Options header to enhance security by controlling frame embedding for UI pages.
What area does it affect? UI security settings
What does the default mean? The default value is "true", which means this behavior is enabled by default.
When should you review it? Review this property when assessing security measures against clickjacking vulnerabilities.

Out of the box property record

Raw metadata from the property record.

Property name glide.set_x_frame_options
Sys ID 6a80a123ff2010003061fe51c17f9dc6
Type boolean
Application Global
Default value true
Description Enable this property to set the X-Frame-Options response header to SAMEORIGIN for all UI pages. The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame> or <iframe>. Sites can use this to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites. https://developer.mozilla.org/en/the_x-frame-options_response_header
Updated 2024-05-25 05:04:13

Sources

Official references and nearby text excerpts where this property appears.

Context preview Snippet 1
... | false • Default: true • Location: System Property [sys_properties] table glide.service_portal.search_as_you_type_behavior Select search suggestions (Suggestions) or type-ahead functionality (Typeahead). For more information about search suggestions, see Enable search suggestions. glide.set_x_frame_options Enables (true) or disables (false) the X-Frame-Options response header to SAMEORIGIN for all UI pages. The X-Frame-Options HTTP response header can be used to indicate whether a browser should be ...
Context preview Snippet 2
... Inc., in the United States and/or other countries. Other company names, product names, and logos may be trademarks of the respective companies with which they are associated. 220 Documentation Updates "glide.set_x_frame_options" is not set to the recommended value of "true", then an instance will be allowed to be framed in an iframe of another page. • Security Risk ◦(Old‎ <blank> ◦(New‎ ...
Context preview Snippet 3
... header Normally, the ServiceNow AI Platform automatically includes the X-Frame-Options: SAMEORIGIN header. • It supports use of this header in all types of browsers, based on the setting of the glide.set_x_frame_options global property, which is enabled by default. • When you configure a page with a Content-Security-Policy: frame-ancestor 'self' URL1 URL2 header, the ServiceNow AI Platform does not automatically include the ...

More in glide (other)

Other properties in the same namespace.

All 489 properties in glide (other) →