Security difference between X-Frame-Options and Content-Security-Policy headers?

Question

These HTTP headers seem to do the same thing, albeit with the latter having a bit more flexibility.

Is there any additional security that the Content-Security-Policy offers?

Unbeknown

Answer 1

X-FRAME-OPTIONS allow you to protect your site from being framed in other sites.

For example X-FRAME-OPTIONS: SAMEORIGIN allows your site to be embedded in an iframe on the same domain only. It's needed to prevent clickjacking attacks.

But Content-Security-Policy has completely different purpose. Specification of CSP says that:

Content Security Policy is a declarative policy that lets the authors (or server administrators) of a web application inform the client about the sources from which the application expects to load resources.

So its main purpose is to protect your site from XSS attacks on your users, by not allowing browsers to loader resources (scripts, etc.) from unknown domains.

Aggi

CSP 2's frame-ancestors has some overlap with X-FRAME-OPTIONS as this too prevents framing and clickjacking attacks. – Bullough

The CSP 2 spec actually explicitly states that it deprecates and replaces X-Frame-Options. Not just overlap. – Rebellion

@ant: In a practical sense it does overlap as browser support catches up. You will need both to support old browsers until your userbase has migrated. – Bullough