Java – how do I deny site access from iframe?

I noticed that some websites refused to access their registration and login pages from iframes for security reasons In my opinion, this is a good idea

I want to know what settings they need to do this because I want to do the same thing on my website The website in question is built in Java and can run on Apache Tomcat

If someone knows how to do this, it would be great if you could share it

Solution

Well, you should use X-FRAME-OPTIONS

Read this article and hope it helps:

http://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx

I'm not familiar with JSPS and servlets, but I think you can do this:

public class NoIFrameAllowedServlet extends HttpServlet {

  public void doGet(HttpServletRequest request,HttpServletResponse response)
      throws ServletException,IOException {
      response.setHeader("x-frame-options","SAMEORIGIN");
    }