Issue metadata
Sign in to add a comment
|
Security: X-Frame-Options
Reported by
pgaut...@gmail.com,
Sep 12
|
||||||||||||||||||||||
Issue descriptionSteps to reproduce the problem: 1. Create the html file and insert website page in iframe tag. 2. Host that html file on localhost. 3. Load that file in Chrome Browser. 4. We can see that Chrome Browser is allowing the page to load in an iframe tag. What is the expected behavior? Browser should not allow the page to be loaded in the iframe tag if the X-Frame-Options headers are enabled on the server. What went wrong? The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame>, <iframe> or <object> . Sites can use this to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites. The added security is only provided if the user accessing the document is using a browser supporting X-Frame-Options. X-Frame-Options header is present on the server and chrome browser is still allowing the application/page to be loaded in an iframe. VERSION Chrome Version: 68.0.3440.106 & 69.0.3497.92 (Official Build) (64-bit) Operating System: Windows 7 64bit Service Pack 1
,
Sep 13
I can't reproduce this issue using the small test attached (`go run server.go` and then open iframe-runner.html in the directory listing. setting X-Frame-Options: deny seems to work). Note that if the framed resource is cached and the XFO header has changed, it may not work (see issue 354080). Can you please provide more details?
,
Sep 14
have you cleared the cache between the two runs?
,
Sep 17
Hi, I have cleared the cache from browser and now its not working. It seems that previously it was picking the pages from cache memory.
,
Sep 17
Thank you for providing more feedback. Adding the requester to the cc list. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
,
Sep 20
Marking as WontFix based on the previous comments.
,
Dec 28
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by gov...@chromium.org
, Sep 12