- From: Adam Barth <w3c@adambarth.com>
- Date: Mon, 7 Dec 2009 20:10:21 -0800
- To: gaz Heyes <gazheyes@gmail.com>
- Cc: Maciej Stachowiak <mjs@apple.com>, Boris Zbarsky <bzbarsky@mit.edu>, Ian Hickson <ian@hixie.ch>, "sird@rckc.at" <sird@rckc.at>, public-web-security@w3.org
On Mon, Dec 7, 2009 at 7:56 PM, gaz Heyes <gazheyes@gmail.com> wrote: > Has an anyone raised the issue that sandboxed iframes actually enable > "clickjacking" when frame buster defences are applied? > > <iframe sandbox="allow-forms" src="http://twitter.com/login"></iframe> > > So here the spec says disable scripts but allow forms, this would render a > javascript frame breaker useless. Frame breakers are already useless. You need to either do what Twitter does (refuse to show the page until you've verified that you're not in a frame) or use X-Frame-Options: deny. Adam
Received on Tuesday, 8 December 2009 04:11:26 UTC