4 ms·
Nope, because they, their frameworks or something in between have no XFO. Which proves it being ineffective, even after so many years.
by homakov 10y ago
Nope, because they, their frameworks or something in between have no XFO. Which proves it being ineffective, even after so many years.
- tptacek 10y agoWhat framework support are we talking about? Isn't the beauty of XFO as a countermeasure is that it doesn't require framework support? Unlike CSRF protection, you could add XFO in an nginx conf if you really wanted.
- homakov 10y agoLast time i checked Express. It is trivial to add, as long as you remember to do it. Actually it is silly nginx or apache don't serve those by default.
- deleted 10y ago[deleted]