Click hijack: X-FRAME-OPTIONS is not configured

X-Frame-Options Not configured
There are three parameters that can be configured ：
1.DENY： The browser refuses to load any Frame page .
2.SAMEORIGIN： The page can only be loaded into the page under the same domain name .
3.ALLOW-FROM uri： Can only be embedded in the framework of the specified domain name .
Generally, it is OK to select the second parameter .

Mode one ： Add settings per page :

<% response.addHeader("x-frame-options","SAMEORIGIN");%>

Mode two ： Add filter settings to the project code ：

public class FrameFilter implements Filter {
 
 
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
    HttpServletRequest request = (HttpServletRequest) req;  
    HttpServletResponse response = (HttpServletResponse) res;  
    // Set up x-frame-options
    response.setHeader("x-frame-options", "SAMEORIGIN");  
    chain.doFilter(request, response);
    }  
 
    public void init(FilterConfig config) throws ServletException {
    }
    
    public void destroy() {
    }

}

then web.xml Configure this filter in , I won't repeat .

Mode three ：tomcat Set in （ If the server used is tomcat, Can be in tomcat Set in ,tomcat All applications will take effect under ）    

tomcat Catalog /conf/web.xml Looking for in httpHeaderSecurity To configure , Just remove the previous comments .
 <filter-mapping>
        <filter-name>httpHeaderSecurity</filter-name>
        <url-pattern>/*</url-pattern>
        <dispatcher>REQUEST</dispatcher>
    </filter-mapping>

<filter>
        <filter-name>httpHeaderSecurity</filter-name>
        <filter-class>org.apache.catalina.filters.HttpHeaderSecurityFilter</filter-class>
        <async-supported>true</async-supported>
        // Add the following code start
      <init-param>
        <param-name>antiClickJackingEnabled</param-name>
        <param-value>true</param-value>
      </init-param>
      <init-param>
        <param-name>antiClickJackingOption</param-name>
        <param-value>SAMEORIGIN</param-value>
      </init-param>    // add to end

    </filter>

All three of the above methods can , It depends on the project ！