title: To stop ClickJacking, which one is more secure? breaking out of iframe vs X-Frame-Options to Deny or Same Origin
body: <p>To prevent clickjacking from happenning for your website, I have noticed several different methods. Some use javascript to have your website break out of iframe, the other soltution is to set the X-FRAME-OPTIONS header to DENY or SAMEORIGIN. 
  Which one of the 2 method I mentioned do you think is more secure? Here is a sample page I am using to test clickjacking.</p>
  
  <pre><code>&lt;HTML&gt;
  &lt;BODY&gt;
  &lt;H1&gt;Clickjacking Test&lt;/H1&gt;
  &lt;IFRAME SRC="http://www.google.com/" HEIGHT="500" WIDTH="500"&gt;&lt;/IFRAME&gt;
  &lt;/BODY&gt;
  &lt;/HTML&gt;
  </code></pre>
  
  <p>With iframe break code you will see Firefox and Safari will be slow to get out of Iframe, meaning you will see Clickjacking test and then it will break out of that iframe and show the original website. With IE and Chrome it is fast that not noticeable. 
  But with X-Frame-Optiions solution you simply do not see your website at all. It will be blocked. Like with google in the above example. So my questions is which one of the solution better? Blocking it completely or breaking out of iframe(slow in 2 browsers)</p>