Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 153 Stack Exchange communities.

What is meta?
Here's how it works:
  1. Any Stack Exchange user can ask a question
  2. The community provides support, votes on ideas, and reports bugs
  3. Your voice helps shape the way Stack Exchange operates

I was just reading a blog article about the security of Google+, and the page mentioned a header I hadn't heard of before: X-Frame-Options

I'll let the Mozilla docs do most of the talking, but suffice it to say this header allows you to say whether or not a page is allowed to be used as part of a frame (there are options to deny the ability outright, or restrict it to pages from the same domain). See also the informational Internet-Draft.

Given that frame busting has been a feature of Stack Overflow for as long as I can remember, doesn't it make sense to include this header as an added layer of protection for those using a somewhat recent browser?

share|improve this question
1  
Wouldn't hurt, I'd say. Nice security feature. – slhck Aug 22 '11 at 10:29
    
Related (also mentions this header): meta.stackexchange.com/questions/70637/…. – balpha Aug 22 '11 at 10:32
3  
@balpha I did see that before I posted this here. Since it hasn't been implemented, I suppose it was sort of an implicit [status-declined] but I figured it wouldn't hurt to bring it up again as a fallback option of sorts. Especially since that answer is close to a year old at this point. – AgentConundrum Aug 22 '11 at 10:38
1  
A nicely illustrated example here. – Arjan Nov 27 '11 at 21:31
2  
This is a nice idea but as with most things on the Internet, it gets broken pretty quickly by proxies that strip it out. – uɐɯsO uɐɥʇɐN Nov 28 '11 at 6:20
8  
@GeorgeEdison At that point, you're really just saying that SO should just go full-HTTPS and encrypt the whole shebang. If you're using an evil proxy, you've already lost anyway. Should SO also stop sending their frame-busting JS in case a proxy swallows the request? This is just a "so long as we're already trying to stop framing, let's go all the way and send an extra 30-40 characters and let the browsers do some of the work" sort of suggestion. It's a supplement to the JS, not a replacement. It's a bit of extra security with negligible cost. – AgentConundrum Nov 28 '11 at 17:00
1  
Listen and learn. – Paul Sweatte Jan 11 '13 at 21:18
1  
This has been implemented at some point. – a cat Feb 8 '13 at 23:54
    
@lunboks Just noticed this myself and came to check this out because I didn't remember this post ever being updated. Flagging for retagging. – Jeremy Banks Feb 14 '13 at 5:40
up vote 3 down vote accepted

This has finally been added:

X-Frame-Options: SAMEORIGIN

and

Refused to display 'stackoverflow.com' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .