For clickjacking framing protection to be effective for your JSPs, the system administrator must configure the whitelist service on the system where your application is deployed.