Review applications for X-Frame-Options header

[sandbergja]

Priority of this ticket

We should do https://github.com/PrincetonUniversityLibrary/security/issues/69 first, since it would provide many of these protections. This would potentially add protections for additional browsers that don't support CSP, which we may or may not need to support.

What maintenance needs to be done

Check our applications to see if they respond with an X-Frame-Options header. For any applications that don't have this protection, determine if the application will ever need to be embedded in an iframe. If not, write a ticket to start responding with clickjacking security headers.

Note that Rails 5 and above defaults to sending 'X-Frame-Options' => 'SAMEORIGIN'

Further reading