3 ms·
unrelated. I create iframe with victim website and i don't set sandbox attribute. And, obviously, victim cannot set sandbox for itself
by homakov 14y ago
unrelated. I create iframe with victim website and i don't set sandbox attribute.
And, obviously, victim cannot set sandbox for itself
- moonboots 14y agoSorry, I misinterpreted your attack, and it's more worrying than I initially thought. I would add some information about the fix, namely adding the header "X-Frame-Options: SAMEORIGIN" [1]. [1] https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Option...
- homakov 14y agoyes SAMEORIGIN/DENY is perfect solution. but, damn it, insecure-by-default and any site is frameable by default so far.