title: X-Frame-Options: DENY is not working for spring boot REST API
body: <p>My Project has ExtJs as Front end and Spring boot as backend. ExtJs will call spring boot which will respond with JSON. I wanted to prevent <code>clickjacking</code> attack in my project. I have a simple html script, which will just load the website in an iframe.If the website is loaded within iframe, then it means it is not secure.I have added the following flags  <code>X-Frame-Options: DENY and Content-Security-Policy: frame-ancestors 'none';</code> in spring boot REST API response to prevent that.But even then, it is not preventing my application to be loaded in <code>iframe</code>. The code to check if clickjacking is possible is </p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>&lt;html&gt;
  &lt;head&gt;
  &lt;title&gt;Clickjack test page&lt;/title&gt;
  &lt;/head&gt;
  &lt;body&gt;
  &lt;p&gt;Website is vulnerable to clickjacking!&lt;/p&gt;
  &lt;iframe src="http://localhost:8000" width="1000" height="1000"&gt;&lt;/iframe&gt;
  &lt;/body&gt;
  &lt;/html&gt;</code></pre>
  </div>
  </div>
  </p>
  
  <p>`</p>
  
  <p>Here, <code>localhost:8000</code> refers to extjs URL.I researched and found out that client side validations to prevent clickjacking is not that effective. So is there any options to prevent clickjacking attack in my project</p>