Bug 23907 - Implement X-Frame-Options
Summary: Implement X-Frame-Options
Alias: None
Product: WebKit
Classification: Unclassified
Component: Frames (show other bugs)
Version: 528+ (Nightly build)
Hardware: All All
: P2 Normal
Assignee: Nobody
URL: http://blogs.msdn.com/ie/archive/2009...
Depends on:
Reported: 2009-02-11 17:30 PST by Adam Barth
Modified: 2011-08-02 02:36 PDT (History)
4 users (show)

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description Adam Barth 2009-02-11 17:30:12 PST
We should implement X-Frame-Options to help sites defend against ClickJacking.  Here is a blog post describing the feature:


I'm not sure this completely solves the ClickJacking problem, but it certainly does more good than harm.  I can ask Eric Lawrence for a more detailed design doc if we want to make sure we match IE's behavior.

Here is the Mozilla bug on this topic:


dveditz seems similarly positively disposed to implementing this feature.
Comment 1 Adam Barth 2009-04-12 14:09:34 PDT
This seems to be done in http://trac.webkit.org/changeset/42333
Comment 2 Sam Weinig 2009-04-12 14:26:08 PDT
Indeed.  I didn't remember this bug when I implemented it.  My bad.
Comment 3 spamfagos 2011-08-02 00:58:17 PDT
The current implementation of X-Frame-Options is not complete!
IE8+ also supports ALLOW-FROM origin:
Are there are plans to implement this in webkit?
Comment 4 Adam Barth 2011-08-02 02:36:35 PDT
X-Frame-Options is currently working its way though the IETF.  I expect we'll implement whatever the final standard says, but it's not entirely clear what that will be at the moment.  Thanks for your interest.