3 ms·
You can serve an X-Frame-Options:"DENY" (or "SAMEORIGIN") header to prevent browsers from loading the iframes.
by sanqui 12y ago
You can serve an X-Frame-Options:"DENY" (or "SAMEORIGIN") header to prevent browsers from loading the iframes.
- sunflowerdeath 12y agoBut this is a response header, so server shoud respond and that is the goal of attack. Browser doesn't send any request headers saying that site is opened in the iframe.
- sanqui 12y agoSure, but at least the browser won't render the page, so it won't download the additional content like images and scripts. It's partial mitigation.