New issue
Advanced search Search tips
Note: Color blocks (like █ or █) mean that a user may not be available. Tooltip shows the reason.

Issue 729909 link

Starred by 1 user
Status: Duplicate
Merged: issue 129139
Owner: ----
Closed: Jun 2017
Cc:
█ mkwst@chromium.org
elawrence@chromium.org
Components:
EstimatedDays: ----
NextAction: ----
OS: ----
Pri: ----
Type: Bug-Security



Sign in to add a comment

Security: Clickjacking when client server set X-Frame-Options:ALLOW-FROM

Reported by bastian....@gmail.com, Jun 6 2017 
VULNERABILITY DETAILS

I see that Chrome browser will ignore X-Frame-Options header when client server use X-Frame-Options:ALLOW-FROM.
Means a clickjacking will works if client server use X-Frame-Options:ALLOW-FROM.

VERSION
Chrome Version: Version 59.0.3071.86
Operating System: Ubuntu 16.04.4 (64-bit)


REPRODUCTION CASE


1.Create a test file in client server with header X-Frame-Options:ALLOW-FROM https://test.com/

2.Create an HTML in your PC that embed it.

3.Open it in your PC and you will see the X-Frame-Options header will be ignored.
chrome.png
82.8 KB View Download

Comment 1 by elawrence@chromium.org, Jun 6 2017

Cc: elawrence@chromium.org mkwst@chromium.org
Components: Blink>SecurityFeature
Labels: -Restrict-View-SecurityTeam allpublic
Yes, that's correct. Chrome does not support ALLOW-FROM, and generally believes that FrameAncestors CSP is the better approach for addressing this attack vector.

 Issue 539525  suggests failing closed and  Issue 129139  notes lack of support for this directive.

Mike-- Has anything (code, your thoughts) changed here recently?

Comment 2 by mkwst@chromium.org, Jun 6 2017 

I don't think that implementing `ALLOW-FROM` is a priority. I wouldn't reject a patch that implemented it, but it's not on any roadmap I know of. So, I think I agree with myself from those bugs you pointed to. :)

I'd also note that we're now walking the whole frame tree when evaluating `SAMEORIGIN`, and would presumably want to do the same for `ALLOW-FROM` in a theoretical implementation. It's not clear to me that we'd be able to do that in a way that didn't break sites that rely on other browser's behavior.

*shrug* `frame-ancestors` seems like the right thing to encourage. It's both more accurate and more flexible.

Comment 3 by elawrence@chromium.org, Jun 6 2017

Mergedinto: 129139
Status: Duplicate (was: Unconfirmed)
►

Sign in to add a comment