Possible Duplicate:
Should Stack Exchange be using the X-FRAME-OPTIONS header?

Yesterday I was hanging out in the PHP chatroom feeling a little bored, and then saw the leave button and remembered that it didn't ask for confirmation, so I tried putting that URL (https://chat.stackoverflow.com/chats/leave/11) into an image src, as I remember was done with the logout URL a while ago by someone else.

It didn't work, as it presented an 'are you sure' page.

Then the Twitter "Don't Click" prank came to mind.

I put the Stack Overflow 'leave all' page in an iframe, expecting it to display the standard For security reasons, framing is not allowed; click OK to remove the frames. message to appear.

Surprisingly, it didn't.

So, I positioned the frame inside a <div> set to overflow: hidden, and made it invisible.

I put a simple WebKit notification test in as a guise, with a button underneath labeled notify.

Then I added the onload attribute to the iframe that would execute a JavaScript function.
The JavaScript function would detect if it had loaded for the first time or not.

If it had loaded for a second time, the script assumes that the leave button has been clicked, and acts as if the button behind it had been (i.e. it displays the test notification).

I tested it, and sure enough, the chat tab went to the 'all rooms' page. I had left the room.

I then posted a message in chat to test it.

Nick was the first to fall for it (sorry Nick).

Levi was the first to notice, but still didn't fully realize what was happening.

Then Shyam noticed.

I was not online by then, and no-one else took any notice of it after that.

This morning I improved it more, and managed to bust the frame-buster-buster-buster.

I had created the frame-buster-buster-buster-buster!

My addition was the a button that logs the user out.

How I did it:

Normally, if you put Stack Overflow in a frame, it will be busted.

I therefore applied a sandbox to the iframe.

I managed to get it to not bust the frames, but is would still display the alert.

I then discovered that I could put sandbox="allow-forms" and it would block scripts, but allow the submission of forms.

The demo is here.


Demo | Demo (half-opacity) | Mirror | Mirror (half-opacity)

  • 1
    Re-tagging this as a bug, as I don't quite see a feature request.
    – Tim Post
    Nov 15, 2012 at 0:51
  • @NickCraver How do we make the duplicate get more attention?
    – uınbɐɥs
    Nov 15, 2012 at 0:54
  • 2
    This is really really cool! ;)
    – jmort253
    Nov 15, 2012 at 4:57

1 Answer 1


It should be a simple fix: set X-Frame-Options to DENY or SAMEORIGIN.

The X-Frame-Options response header | MDN

Not the answer you're looking for? Browse other questions tagged .