Should Stack Exchange be using the X-FRAME-OPTIONS header?
Yesterday I was hanging out in the PHP chatroom feeling a little bored, and then saw the
leave button and remembered that it didn't ask for confirmation, so I tried putting that URL (
http://chat.stackoverflow.com/chats/leave/11) into an image
src, as I remember was done with the logout URL a while ago by someone else.
It didn't work, as it presented an 'are you sure' page.
Then the Twitter "Don't Click" prank came to mind.
I put the Stack Overflow 'leave all' page in an
iframe, expecting it to display the standard
For security reasons, framing is not allowed; click OK to remove the frames. message to appear.
Surprisingly, it didn't.
So, I positioned the frame inside a
<div> set to
overflow: hidden, and made it invisible.
I put a simple WebKit notification test in as a guise, with a button underneath labeled
Then I added the
onload attribute to the
If it had loaded for a second time, the script assumes that the
leave button has been clicked, and acts as if the button behind it had been (i.e. it displays the test notification).
I tested it, and sure enough, the chat tab went to the 'all rooms' page. I had left the room.
I was not online by then, and no-one else took any notice of it after that.
This morning I improved it more, and managed to bust the frame-buster-buster-buster.
I had created the frame-buster-buster-buster-buster!
My addition was the a button that logs the user out.
How I did it:
Normally, if you put Stack Overflow in a frame, it will be busted.
I therefore applied a
sandbox to the
I managed to get it to not bust the frames, but is would still display the alert.
I then discovered that I could put
sandbox="allow-forms" and it would block scripts, but allow the submission of forms.