5 ms·

X-frame-options is obsolete. Most browsers complain loudly on the console or ignore the header. Use csp instead

by the_common_man 7y ago

floatingatoll 7y ago
For those wondering, CSP ‘frame-ancestors’ if I remember correctly.
- user5994461 7y ago
  It's a shame browsers are breaking the X-Frame-Options. It was an easy option to force with load balancers or any intermediate server. Frames should always be blocked on the open internet. The content security policy can't be adjusted easily. It screws with applications and frameworks that use it for any of the twenty other options it covers.
  - floatingatoll 7y ago
    Why? It’s been deprecated for years and years. You don’t have to set any of the other 20 CSP options to set CSP:frame-ancestors. There’s no reason to avoid it except taking a completionist approach to CSP headers (“we have to set all possible CSP attributes for maximum security in a single go on our first try”) which I strongly discourage.
    - user5994461 7y ago
      You can't just do a "set header Content-Security-Policy frame-ancestors none" on all traffic. This is gonna break anything using CSP for any of the 20 settings it provides.
      - floatingatoll 7y ago
        Correct. You would be expected to merge it into any CSP headers used by your app, either using (in your Apache scenario) If/Else and Header modify or by modifying your application where appropriate. While XFO is simpler to overwrite on a global basis, it’s imprecise and doesn’t permit “allow certain sites to frame, deny all others” and is likely to become fully unsupported whenever any CSP policy is defined, given its deprecated status. Taking the XFO way out will only help you short-term at best.
will4274 7y ago
> X-frame-options is obsolete. Most browsers complain loudly on the console or ignore the header. The deny option seems to work just fine. My default browser (Firefox) doesn't complain. MDN doesn't indicate any browsers have dropped support. Plus, dropping support would be an unmitigated and unnecessary unforced security error, by making old sites insecure. Do you have a link to an example of a browser ignoring the header?

X-frame-options is obsolete. Most browsers complain loudly on the console or ignore the header. Use csp instead

floatingatoll 7y ago

For those wondering, CSP ‘frame-ancestors’ if I remember correctly.

user5994461 7y ago
It's a shame browsers are breaking the X-Frame-Options. It was an easy option to force with load balancers or any intermediate server. Frames should always be blocked on the open internet. The content security policy can't be adjusted easily. It screws with applications and frameworks that use it for any of the twenty other options it covers.
- floatingatoll 7y ago
  Why? It’s been deprecated for years and years. You don’t have to set any of the other 20 CSP options to set CSP:frame-ancestors. There’s no reason to avoid it except taking a completionist approach to CSP headers (“we have to set all possible CSP attributes for maximum security in a single go on our first try”) which I strongly discourage.
  - user5994461 7y ago
    You can't just do a "set header Content-Security-Policy frame-ancestors none" on all traffic. This is gonna break anything using CSP for any of the 20 settings it provides.
    - floatingatoll 7y ago
      Correct. You would be expected to merge it into any CSP headers used by your app, either using (in your Apache scenario) If/Else and Header modify or by modifying your application where appropriate. While XFO is simpler to overwrite on a global basis, it’s imprecise and doesn’t permit “allow certain sites to frame, deny all others” and is likely to become fully unsupported whenever any CSP policy is defined, given its deprecated status. Taking the XFO way out will only help you short-term at best.

will4274 7y ago

> X-frame-options is obsolete. Most browsers complain loudly on the console or ignore the header. The deny option seems to work just fine. My default browser (Firefox) doesn't complain. MDN doesn't indicate any browsers have dropped support. Plus, dropping support would be an unmitigated and unnecessary unforced security error, by making old sites insecure. Do you have a link to an example of a browser ignoring the header?