What this test does
Checks the authorization endpoint response for X-Frame-Options or a CSP frame-ancestors directive.
How it passes
One of them prevents framing by other sites (clickjacking).
- Specification
- RFC 9700 §4.16
- Needs
- S106 Authorization endpoint is listed