What is meta? ×
Meta Stack Exchange is where users like you discuss bugs, features, and support issues that affect the software powering all 142 Stack Exchange communities.

I was just reading a blog article about the security of Google+, and the page mentioned a header I hadn't heard of before: X-Frame-Options

I'll let the Mozilla docs do most of the talking, but suffice it to say this header allows you to say whether or not a page is allowed to be used as part of a frame (there are options to deny the ability outright, or restrict it to pages from the same domain). See also the informational Internet-Draft.

Given that frame busting has been a feature of Stack Overflow for as long as I can remember, doesn't it make sense to include this header as an added layer of protection for those using a somewhat recent browser?

share|improve this question
Wouldn't hurt, I'd say. Nice security feature. –  slhck Aug 22 '11 at 10:29
Related (also mentions this header): meta.stackexchange.com/questions/70637/…. –  balpha Aug 22 '11 at 10:32
@balpha I did see that before I posted this here. Since it hasn't been implemented, I suppose it was sort of an implicit [status-declined] but I figured it wouldn't hurt to bring it up again as a fallback option of sorts. Especially since that answer is close to a year old at this point. –  AgentConundrum Aug 22 '11 at 10:38
A nicely illustrated example here. –  Arjan Nov 27 '11 at 21:31
This is a nice idea but as with most things on the Internet, it gets broken pretty quickly by proxies that strip it out. –  uɐɯsO uɐɥʇɐN Nov 28 '11 at 6:20
@GeorgeEdison At that point, you're really just saying that SO should just go full-HTTPS and encrypt the whole shebang. If you're using an evil proxy, you've already lost anyway. Should SO also stop sending their frame-busting JS in case a proxy swallows the request? This is just a "so long as we're already trying to stop framing, let's go all the way and send an extra 30-40 characters and let the browsers do some of the work" sort of suggestion. It's a supplement to the JS, not a replacement. It's a bit of extra security with negligible cost. –  AgentConundrum Nov 28 '11 at 17:00
Listen and learn. –  Paul Sweatte Jan 11 '13 at 21:18
This has been implemented at some point. –  lunboks Feb 8 '13 at 23:54
@lunboks Just noticed this myself and came to check this out because I didn't remember this post ever being updated. Flagging for retagging. –  Jeremy Banks Feb 14 '13 at 5:40

1 Answer 1

up vote 3 down vote accepted

This has finally been added:

X-Frame-Options: SAMEORIGIN


Refused to display 'stackoverflow.com' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .