4 ms·
but the request has already been sent. Yes, the browsers will respect this header and not display the page and not run javascript, BUT what if the user tracking
by ishener 11y ago
but the request has already been sent. Yes, the browsers will respect this header and not display the page and not run javascript, BUT what if the user tracking is done on the server in the first request? In that case, this technique might work...
- deleted 11y ago[deleted]
- orf 11y agoI assume they make a preflight HEAD request the same as CORS, in which case they would have to be very sloppy to make that count towards the stats.
- realityking 11y agoNope. There's no preflight for X-Frame-Options, as it was designed as a click jacking prevention.