Clickjacking-Schutz für Astro konfigurieren

// src/middleware.ts -- Clickjacking-Schutz (SSR)
import { defineMiddleware } from 'astro:middleware';

export const onRequest = defineMiddleware(async (context, next) => {
  const response = await next();

  // X-Frame-Options (Legacy-Browser)
  response.headers.set('X-Frame-Options', 'DENY');

  // frame-ancestors in CSP (modern, bevorzugt)
  // Wird typischerweise im CSP-Header gesetzt:
  // Content-Security-Policy: ... frame-ancestors 'none'

  return response;
});

// src/middleware.ts -- X-Frame-Options + CSP frame-ancestors
import { defineMiddleware } from 'astro:middleware';

export const onRequest = defineMiddleware(async (context, next) => {
  const response = await next();

  // Beide Header setzen für maximale Kompatibilität
  response.headers.set('X-Frame-Options', 'DENY');
  response.headers.set('Content-Security-Policy',
    response.headers.get('Content-Security-Policy')
      ? response.headers.get('Content-Security-Policy') + "; frame-ancestors 'none'"
      : "frame-ancestors 'none'"
  );

  return response;
});

# X-Frame-Options prüfen
curl -sI https://ihre-domain.de | grep -i x-frame
# X-Frame-Options: DENY

# frame-ancestors in CSP prüfen
curl -sI https://ihre-domain.de | grep -i content-security-policy
# Content-Security-Policy: ... frame-ancestors 'none'

# Iframe-Test (Browser-Console, sollte blockiert werden):
# Refused to display in a frame because 'X-Frame-Options' is set to 'DENY'