58

I was just reading a blog article about the security of Google+, and the page mentioned a header I hadn't heard of before: X-Frame-Options

I'll let the Mozilla docs do most of the talking, but suffice it to say this header allows you to say whether or not a page is allowed to be used as part of a frame (there are options to deny the ability outright, or restrict it to pages from the same domain). See also the informational Internet-Draft.

Given that frame busting has been a feature of Stack Overflow for as long as I can remember, doesn't it make sense to include this header as an added layer of protection for those using a somewhat recent browser?

  • 1
    Wouldn't hurt, I'd say. Nice security feature. – slhck Aug 22 '11 at 10:29
  • Related (also mentions this header): meta.stackexchange.com/questions/70637/…. – balpha Aug 22 '11 at 10:32
  • 3
    @balpha I did see that before I posted this here. Since it hasn't been implemented, I suppose it was sort of an implicit [status-declined] but I figured it wouldn't hurt to bring it up again as a fallback option of sorts. Especially since that answer is close to a year old at this point. – AgentConundrum Aug 22 '11 at 10:38
  • 1
    A nicely illustrated example here. – Arjan Nov 27 '11 at 21:31
  • 2
    This is a nice idea but as with most things on the Internet, it gets broken pretty quickly by proxies that strip it out. – uɐɯsO uɐɥʇɐN Nov 28 '11 at 6:20
  • 8
    @GeorgeEdison At that point, you're really just saying that SO should just go full-HTTPS and encrypt the whole shebang. If you're using an evil proxy, you've already lost anyway. Should SO also stop sending their frame-busting JS in case a proxy swallows the request? This is just a "so long as we're already trying to stop framing, let's go all the way and send an extra 30-40 characters and let the browsers do some of the work" sort of suggestion. It's a supplement to the JS, not a replacement. It's a bit of extra security with negligible cost. – AgentConundrum Nov 28 '11 at 17:00
  • 1
    Listen and learn. – Paul Sweatte Jan 11 '13 at 21:18
  • 1
    This has been implemented at some point. – a cat Feb 8 '13 at 23:54
  • @lunboks Just noticed this myself and came to check this out because I didn't remember this post ever being updated. Flagging for retagging. – Jeremy Banks Feb 14 '13 at 5:40
4

This has finally been added:

X-Frame-Options: SAMEORIGIN

and

Refused to display 'stackoverflow.com' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .