8 ms·

X-Frame-Options should fix it now? If a server sets that header, the browser shouldn't show it in a frame. But of course, the server has to be set up properly.

by hnick 6y ago

X-Frame-Options should fix it now? If a server sets that header, the browser shouldn't show it in a frame. But of course, the server has to be set up properly. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-... Edit: looks like Safari, IE, and Edge don't check all ancestors which is a potential flaw. Chrome and Firefox do though.

oefrha 6y ago
Yes, except some pages are designed to be embedded (like the Google login widget in the linked article), and those may still be vulnerable to clickjacking. If your page isn’t explicitly designed to be embedded then at least SAMEORIGIN is basically a must. In fact most run of the mill security checkers would warn you if you don’t prevent cross origin iframe embedding.