3 ms·
Saying that a header is useless because it has been deprecated and displaced by a newer header is... misleading at best. If all you ever code for is the latest
by phyzome 8y ago
Saying that a header is useless because it has been deprecated and displaced by a newer header is... misleading at best.
If all you ever code for is the latest version of Firefox and Chrome, you might not understand this, but there's a whole world out there with an astonishing diversity of browsers. (Also, your site is bad and you should feel bad.) Removing X-Frame-Options without first checking if 99.99% of your users' browsers support Content-Security-Policy is just asking for increased risk.
- organicmultiloc 8y agoI've worked on a lot of cross browser bugs since IE5, never seen one created by any header or created by omitting http headers. Honestly your comment is just nonsense.
- ovao 8y agoPrematurely axing X-Frame-Options would expose a security risk, not a “bug”, per se.
- tatersolid 8y agoHeaders which have caused production bugs or misbehaviors during my career (mostly in proxies and old IE): Content-Encoding Vary Cache-Control (proxies ignoring private usually) Content-Disposition X-UA-Compatible P3P Strict-Transport-Security X-Forwarded-For Via Referrer