4 ms·
Clickjacking is dead, because we have X-Frame-Options! (said no one ever). Opt in solution is not a solution. But still useful.
by homakov 10y ago
Clickjacking is dead, because we have X-Frame-Options! (said no one ever).
Opt in solution is not a solution. But still useful.
- tptacek 10y agoXFO is a pretty solid response to "clickjacking", which is nowhere nearly as prevalent as CSRF as a result. If you can trivially mitigate a vulnerability from a single location in your code, that vulnerability doesn't have much life left in it.
- homakov 10y agoHm, okay, except 90% of my clients still have it :D
- tptacek 10y agoBecause they don't enable XFO? Do they think they need arbitrary frames?
- homakov 10y agoNope, because they, their frameworks or something in between have no XFO. Which proves it being ineffective, even after so many years.
- tptacek 10y agoWhat framework support are we talking about? Isn't the beauty of XFO as a countermeasure is that it doesn't require framework support? Unlike CSRF protection, you could add XFO in an nginx conf if you really wanted.
- homakov 10y agoLast time i checked Express. It is trivial to add, as long as you remember to do it. Actually it is silly nginx or apache don't serve those by default.
- deleted 10y ago[deleted]
- Ajedi32 10y agoAnd SQL injection is dead because we have prepared statements! Yeah, the headline is certainly exaggerating quite a bit.