3 ms·
All websites are supposed to set the header X-Frame-Options: DENY to block iframes. It's a solved problem.
by user5994461 8y ago
All websites are supposed to set the header X-Frame-Options: DENY to block iframes. It's a solved problem.
- empyrical 8y agoThat doesn't solve the issue of clickjacking attempts on pages meant to be in iframes (FB like buttons are in iframes)
- unilynx 8y agoThat solves clickjacking for things which don't want to be iframed, but not for things like the Like button or login buttons which specifically need to be embedded into an existing page (and they were the attack vector for this article)