285666 2025-01-09 03:10:40 -0800 FF (0x0c) stripped from X-Frame-Options even though only HTTP whitespace should be stripped 2026-01-26 12:23:24 -0800 1 1 1 Unclassified WebKit Page Loading Safari 18 Unspecified macOS 15 RESOLVED DUPLICATE 272745 InRadar P2 Normal --- 1 jannis.rautenstrauch webkit-unassigned achristensen annevk beidson charliew karlcow m_finkel webkit-bug-importer wilander youennf oldest_to_newest 2086034 0 jannis.rautenstrauch 2025-01-09 03:10:40 -0800 Form feeds (0x0c) are not allowed as spaces in X-Frame-Options that only allows HTTP whitespace(https://fetch.spec.whatwg.org/#http-whitespace). However, Blink strips these characters and for example blocks a resource with `X-Frame-Options: DENY\x0c`. Example URL: http://sub.headers.websec.saarland/_hp/tests/framing.sub.html?resp_type=parsing&browser_id=1&label=XFO&first_id=3591&last_id=3591&scheme=http&t_resp_id=3591&t_element_relation=iframe_direct&t_resp_origin=https://headers.webappsec.eu Related bug (VT):https://bugs.webkit.org/show_bug.cgi?id=272745, note that FF seem to be allowed in CSP which uses ascii-whitespace(https://w3c.github.io/webappsec-csp/#grammardef-optional-ascii-whitespace) which contains \x0c 2087713 1 webkit-bug-importer 2025-01-16 03:11:15 -0800 <rdar://problem/143037737> 2175213 2 annevk 2026-01-26 12:23:24 -0800 *** This bug has been marked as a duplicate of bug 272745 ***