Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I'm trying to understand when Framebusting should and shouldn't be used. At first brush I'd want to apply that to all pages in my site and generating exceptions as necessary.

On the other hand, if I were to take a minimalist approach, I would think I would want to apply this security to my login page.

  • Is there any reason why I shouldn't apply framebusting to a login page?

  • Are there any other related best practices?

share|improve this question

1 Answer

up vote 1 down vote accepted

From what I've seen Framebusting as a technique is becoming somewhat deprecated as a defence against click-jacking style attacks in favour of setting the X-Frame-Options header (e.g. the OWASP page here and here). Browser support for the X-Frame-Options headers seems to go back to IE8 so unless you have a really old set of browsers to support it should work ok.

So the short answer is that I'd recommend going down that line rather than using Framebusting Javascript.

share|improve this answer
So I should use X-Frame-Options on all pages in a site? ... likely starting at the login page? – makerofthings7 Feb 22 at 16:11
I'd say so, If the site doesn't require frames at all then I'd see no downside to setting X-FRAME-OPTIONS 'DENY' for all pages. – Rory McCune Feb 22 at 16:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.