On 19/08/13 21:31, Hill, Brad wrote: > I received a question as to whether all browsers really implement the > top-level only check, or if any do an immediate parent or ancestor walk. I > could guess, but I'd rather test. Here's a test case for public use: > > http://webappsec-test.info/~bhill2/XFO/XFO_Top.html > > I checked the latest IE, Chrome, Opera and Firefox and they all render the > innermost frame. (don't have a Safari instance handy at the moment to test > but welcome others' reports)
I just tested Safari and can confirm that they do render the innermost frame. (i.e. render based on the top-level frame.) Strangely: I found in my old notes from the first version of the draft from 2011/2012 that not all browsers would use the same algorithm for X-Frame-Options: SAMEORIGIN. But obviously they do now (as tested and verified). I will adjust the text in version -11 for section 5 accordingly and remove in section 5 sub-bullet a). Special thanks to Brad for creating the test web page and cross-verifying. Thanks, Tobias Ps.: apologies, it may take up to 48 hours for me to submit the new text for version-11 as I will have a busy work day tomorrow. :-( > > -Brad > ________________________________________ > From: Hill, Brad > Sent: Friday, August 16, 2013 4:44 PM > To: Richard Barnes; The IESG > Cc: [email protected]; [email protected]; > [email protected] > Subject: RE: [websec] Richard Barnes' Discuss on > draft-ietf-websec-x-frame-options-09: (with DISCUSS and COMMENT) > > Additional comments inline. > ________________________________________ > > > (D3) Shouldn't ALLOW-FROM be followed by an origin, not a URI? In other > words, what does it mean to send "X-Frame-Options: ALLOW-FROM > https://example.com/this/is/a/path?query#fragment";? > > [Hill, Brad] Agreed. > > > (D3) In the ALLOW-FROM: what does "top level context" mean? Do you > really mean the top level here, as opposed to the next one up? For > example, suppose A loads B in an iframe, and B loads C, and then C sends > an X-Frame-Options header with ALLOW-FROM. Is the ALLOW-FROM origin > compared to B or A? In either case, you should also note the attacks > that remain. For example, if the answer is B, then B needs to use > X-Frame-Options as well, or else, A can maliciously frame A within B. Or > if the answer is A, then C is trusting A not to load any malicious > intermediate frames B. > > [Hill, Brad] This really does mean the top/final origin value in a frame > ancestor > chain walk. Browsers have implemented X-Frame-Options to check the > Origin context that is topmost in the window or tab. (the _top target, > representing the full, original browsing context, not just the immediate > parent frame) This could be clarified perhaps, but is not incorrect. > _______________________________________________ websec mailing list [email protected] https://www.ietf.org/mailman/listinfo/websec
