title: X-Frames-Options in the meta tag
body: <p>I've created an test application where i look into the different defense techniques against Clickjacking and other UI redressing attacks. One of the most used techniques is the X-Frames-Options along the Frame-Busting code. What i fail to understand is the reason why the following isn't recommended, and according to OWASP: (<a href="https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet" rel="nofollow">https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet</a>) doesn't work (Even though it works in my test applciation, i can't frame the page if the following is included)</p>
  
  <pre><code> &lt;meta http-equiv="X-Frame-Options" content="deny"&gt;
  </code></pre>
  
  <p>Any explanation or link to an answer would be greatly appreciated.</p>
  
  <p>Apparently this is because the META tag might not be received until information has already rendered in the subframe. This still works in browser such as Chrome and Firefox, but is ignored by IE.</p>