title: X-FRAME-OPTIONS set to deny but still opening iframes in clickjackers
body: <p>I am trying to avoid clickjacking for the application. So, I set the x-frame-options header to deny but it is still opening iframes and any clickjack testing sites.</p>
  <pre><code>app.all('*', (req, res, next) =&gt; {
  console.log('Before processing - ', req.url, req.method);
  res.header('Access-Control-Allow-Credentials', true);
  res.header('Cache-Control', 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0');
  res.header('Access-Control-Allow-Origin', req.headers.origin);
  res.header('Strict-Transport-Security', 'maxAge=100000');
  res.header('X-Frame-Options', 'DENY');
  res.header('Content-Security-Policy', &quot;frame-ancestors 'none'&quot;);
  res.header('Access-Control-Allow-Methods', 'GET,PUT,POST,DELETE');
  res.header('Access-Control-Allow-Headers', 'Cookies, cookies, x-access-token, Origin, Content-Type,    Accept');
  return next();
  });
  </code></pre>