58

I was just reading a blog article about the security of Google+, and the page mentioned a header I hadn't heard of before: X-Frame-Options

I'll let the Mozilla docs do most of the talking, but suffice it to say this header allows you to say whether or not a page is allowed to be used as part of a frame (there are options to deny the ability outright, or restrict it to pages from the same domain). See also the informational Internet-Draft.

Given that frame busting has been a feature of Stack Overflow for as long as I can remember, doesn't it make sense to include this header as an added layer of protection for those using a somewhat recent browser?

Improve this question
9
  • 1
    Wouldn't hurt, I'd say. Nice security feature.
    – slhck
    Aug 22, 2011 at 10:29
  • Related (also mentions this header): meta.stackexchange.com/questions/70637/….
    – balpha StaffMod
    Aug 22, 2011 at 10:32
  • 3
    @balpha I did see that before I posted this here. Since it hasn't been implemented, I suppose it was sort of an implicit [status-declined] but I figured it wouldn't hurt to bring it up again as a fallback option of sorts. Especially since that answer is close to a year old at this point.
    – AgentConundrum
    Aug 22, 2011 at 10:38
  • 1
    A nicely illustrated example here.
    – Arjan
    Nov 27, 2011 at 21:31
  • 2
    This is a nice idea but as with most things on the Internet, it gets broken pretty quickly by proxies that strip it out.
    – uɐɯsO uɐɥʇɐN
    Nov 28, 2011 at 6:20
  • 8
    @GeorgeEdison At that point, you're really just saying that SO should just go full-HTTPS and encrypt the whole shebang. If you're using an evil proxy, you've already lost anyway. Should SO also stop sending their frame-busting JS in case a proxy swallows the request? This is just a "so long as we're already trying to stop framing, let's go all the way and send an extra 30-40 characters and let the browsers do some of the work" sort of suggestion. It's a supplement to the JS, not a replacement. It's a bit of extra security with negligible cost.
    – AgentConundrum
    Nov 28, 2011 at 17:00
  • 1
    Listen and learn.
    – Paul Sweatte
    Jan 11, 2013 at 21:18
  • 1
    This has been implemented at some point.
    – a cat
    Feb 8, 2013 at 23:54
  • @lunboks Just noticed this myself and came to check this out because I didn't remember this post ever being updated. Flagging for retagging.
    – Jeremy
    Feb 14, 2013 at 5:40

1 Answer 1

Reset to default
4

This has finally been added:

X-Frame-Options: SAMEORIGIN

and

Refused to display 'stackoverflow.com' in a frame because it set 'X-Frame-Options' to 'SAMEORIGIN'

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .