3 ms·
There’s an HTTP header you can add that prevents a page being in an iframe, but go off, king.
by earthboundkid 3y ago
There’s an HTTP header you can add that prevents a page being in an iframe, but go off, king.
- deleted 3y ago[deleted]
- sudhirj 3y agoYup. The article mentions it was an “explicit” decision to use this approach instead. Seems much more effective than CSP headers.
- moolcool 3y ago> The mature and responsible thing to do would have been to add a content security policy to the page OP knows that
- mbakke 3y agoThey explicitly mention that in the famous article, but concede that they are not mature enough for that.
- deleted 3y ago[deleted]
- seanhunter 3y agoJust so anyone searching this thread is aware, "Content-Security-Policy:... frame-ancestors 'none';" is what you are (I think) referring to. https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...
- tetha 3y agoOh, TIL X-Frame-Options has been superseeded. That was the header I was thinking about.
- seanhunter 3y agoYeah I set them both just in case people have an ancient user agent but I think that's not required any more.