Good day!
Our security testing team noted that it was possible to capture the login page of the application within a HTML frame of another page as well as all the keystrokes that are entered by the user. In addition, it was also possible to authenticate the web application within the HTML frame. It was also noted that there was no ‘X-Frame-Options’ header in the HTTP response.
May we request for a fix for this?
Thank you!