You may be right about X-XSS-Protection (with the IE8 bug) and Access-Control-Allow-Origin (when set to "*"), but I wouldn't say that X-Frame-Options reduces se

You may be right about X-XSS-Protection (with the IE8 bug) and Access-Control-Allow-Origin (when set to "*"), but I wouldn't say that X-Frame-Options reduces security. It has two possible values, SAMEORIGIN and DENY, both of which help prevent clickjacking attacks without allowing any additional cross-communication.