h5bp/html5-boilerplate — Issue #828: Implement X-Frame-Options headers (avoid Google Books like CSRF attack vector)
Author: teemujonkkari
Created: 2011-10-28 11:27:05+00:00
State: open

This could be one optional security feature to implement in .htaccess.

Possible CSRF attact vector example:
http://amolnaik4.blogspot.com/2011/09/remove-google-books-with-clickjacking.html

Solution:
https://developer.mozilla.org/en/The_X-FRAME-OPTIONS_response_header

Header always append X-Frame-Options DENY | SAMEORIGIN