2 ms·

Hm, okay, except 90% of my clients still have it :D

• tptacek 10y ago
  Because they don't enable XFO? Do they think they need arbitrary frames?
  • homakov 10y ago
    Nope, because they, their frameworks or something in between have no XFO. Which proves it being ineffective, even after so many years.
    • tptacek 10y ago
      What framework support are we talking about? Isn't the beauty of XFO as a countermeasure is that it doesn't require framework support? Unlike CSRF protection, you could add XFO in an nginx conf if you really wanted.
      • homakov 10y ago
        Last time i checked Express. It is trivial to add, as long as you remember to do it. Actually it is silly nginx or apache don't serve those by default.
      • deleted 10y ago
        [deleted]