Medium severityGoInsecure ConfigurationHIGH confidence
Disabled Security Header
A security response header is set to a value that disables its protection (CWE-693/CWE-1021).
Standards mapping
- CWE
- CWE-693: Protection Mechanism FailureCWE-1021: Improper Restriction of Rendered UI Layers or Frames
- OWASP Top 10
- A05:2021 - Security Misconfiguration
- OWASP ASVS
- V14.4.3 (L1)
Vulnerable vs. safe
Flagged by this check
w.Header().Set("X-Frame-Options", "ALLOWALL")Passes - the safe pattern
w.Header().Set("X-Frame-Options", "DENY")Why it matters & how to fix it
A security response header is set to a value that disables its protection (CWE-693/CWE-1021). For example X-Frame-Options: ALLOWALL permits framing (clickjacking), an empty CSP removes injection defenses, and HSTS max-age=0 turns off HTTPS enforcement. Set these headers to protective values (e.g. X-Frame-Options: DENY, a restrictive CSP, HSTS with a long max-age).
References
Rule ID integsec-go-disabled-security-header - engine: Opengrep - license: MIT - Copyright (c) IntegSec Inc.
TurboPentest runs this check automatically
Connect a GitHub repo and this check runs on every white-box pentest - AI-validated and reported with proof, from $99 per target.
Start a pentestRelated checks
- JavaScript / TypeScript - Insecure ConfigurationCORS Acao Wildcard Header
- JavaScript / TypeScript - Insecure ConfigurationCORS Wildcard Origin
- JavaScript / TypeScript - Insecure ConfigurationCORS Wildcard With Credentials
- JavaScript / TypeScript - Insecure ConfigurationCSRF Protection Disabled
- JavaScript / TypeScript - Insecure ConfigurationExpress Trust Proxy All
- JavaScript / TypeScript - Insecure ConfigurationExpress X Powered By Enabled