---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Implement the x-frame-options: SAMEORIGIN security header \[Updated in Security Center 1.3\]

# Implement the x-frame-options: SAMEORIGIN security header \[Updated in Security Center 1.3\] {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Use the glide.set_x_frame_options property to set the X-Frame-Options response header to SAMEORIGIN for all UI pages.
Use the X-Frame-Options HTTP response header to indicate whether browser should be allowed to render a page in a `<frame>` or `<iframe>`. Sites can use this function to avoid
clickjacking attacks by ensuring that their content is not embedded into other sites. An attacker could embed your page into their own page and make your page elements perform maliciously. The end user may think the page is
legitimate because it resembles your page. The end user may click on elements like usual only to have malicious scripts or elements run.

## More information {#sc-x-frame-options-sameorigin__section_more_information}

{#sc-x-frame-options-sameorigin__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Property name | glide.set_x_frame_options |
| Configuration type | System Properties (/sys_properties_list.do) |
| Category | [Configuration](https://servicenow-prod.fluidtopics.net/s9Iz8esR6282THUNXoEpzg "The Configuration category ensures applications have a secure build environment and hardened third party library components. Specifically, ensuring a build and deploy pipeline is repeatable and includes automated testing and prevents known security issues from being deployed. This includes keeping dependencies up to date and free from known vulnerabilities.") |
| Purpose | To mitigate against ClickJacking attacks. |
| Recommended value | true |
| Default value | true |
| Security risk rating | 5.9 |
| Functional impact | This remediation enforces the restriction for rendering a ServiceNow AI Platform application in a third-party application in the form of an iFrame. If you have such an integration, the application wouldn't render in the customized third-party app. |
| Security risk | (Medium) The Same Origin policy enables you to restrict a domain from retrieving a script or a resource from another domains. All modern browsers support this functionality. The policy validates the connection based on protocol, port, and host. CORS (Cross Origin Request) is a modification to Same Origin Policy that enables access to resources/scripts from another domain when explicitly stated as a part of header value. * In this case, the X-Frame-Options header controls whether the ServiceNow AI Platform application can be rendered on the third-party website. * It reduces the sensitive exposure, because the property value, when set to SAMEORIGIN doesn't enable the rendering to happen. {#sc-x-frame-options-sameorigin__ul_fcw_rpp_pkb} |
| References | [Available system properties](https://www.servicenow.com/docs/access?context=r_AvailableSystemProperties&version=australia&pubname=australia-platform-administration&ft:locale=en-US) [Configure iFrames](https://www.servicenow.com/docs/access?context=t_IFrame&version=australia&pubname=australia-platform-user-interface&ft:locale=en-US) |
[ ]

{#sc-x-frame-options-sameorigin__table_ajc_b43_3kb}

To learn more about adding or creating a system
property, see [Add a system property](https://www.servicenow.com/docs/access?context=t_AddAPropertyUsingSysPropsList&version=australia&pubname=australia-platform-administration&ft:locale=en-US).