Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

It is commonly known that loading your site inside a frame on another site, can potentially expose your site to all kinds of ills, and in general is not a good idea if you have any sensitive data to protect.
Thus, the FrameBusting scripts came about, typically a simple script that runs as the site is loading; if its in a frame it reloads itself without frames.
Usually something simple along these lines:

if (top != self) 
    top.location.replace(location);

Now, if you're on a public site, such as forum, or social networking site, where it is common to post links, and have them displayed in a frame, you might want to framebust your site (if you have anything sensitive there, are have users login, etc), out of the social networking's frames. But you also don't want to disrupt the user's experience, and cause them to think the site they're being linked to is suspicious... So you might be tempted to give them a popup to inform them whats going on - but that might just scare them even more....

So - which do you think would be the OVERALL best solution, considering the entirety of context, risks, and consequences, and avoiding "security theater"?

  • Leave the site inside a frame
  • Framebust silently
  • Provide a popup, just to notify the user what is going on
  • Provide a popup to the user with the option to cancel

P.S. The site was THIS site, and I found this out when posting the site to numerous security-related groups on LinkedIn after the public beta started (why dont you? ;) ), having received soem negative responses... Turns out, SE goes for option 3 - popup with no option to cancel. Crossposted as a bug to meta....

share|improve this question
1  
As an addendum - Is it possible to only framebust some sites? Suppose I want select trusted social sites to be able to use a frame, but no others so that I can still reap the benefit of the social sites, but not have to worry about other sites that might use the frame maliciously. –  VirtuosiMedia Nov 21 '10 at 9:00
1  
@VirtuosiMedia, good point / suggestion. I'm sure it's technically possible to whitelist certain sites, but the question is can this be subverted. –  AviD Nov 21 '10 at 11:29

2 Answers 2

up vote 5 down vote accepted

Nice question. FrameBusting is hard to implement correctly and in nearly all cases it is broken due to reasons like browsers incompatibility, bugs, or developers mistakes.

Recently came across on quite similar question here: http://stackoverflow.com/questions/958997/frame-buster-buster-buster-code-needed. Where is said to prompt user with brief explanation of what is going on. Can not disagree, the simpler explanation - better for user understanding, just beware not to miss details touching users privacy. With given details, user has to think on his own what to do not being scared.

And OWASP has good research paper about this topic: http://www.owasp.org/images/0/0e/OWASP_AppSec_Research_2010_Busting_Frame_Busting_by_Rydstedt.pdf

share|improve this answer
    
Original paper referenced on OWASP I believe is here: seclab.stanford.edu/websec/framebusting –  Tate Hansen Nov 21 '10 at 5:04
    
+1, very good. But, where do you weigh in on the cancel option? Do you agree the user should have that option, or dya think the way it is now is ok? (really, go try it out - I find it dodgy too - and I POSTED the **** link!). –  AviD Nov 21 '10 at 6:36
    
@Jeff Atwood added some more details in his answer on Meta –  AviD Nov 22 '10 at 10:03
    
I am not registered at LinkedIn, so I am no able to reproduce that alert. But that what @Jeff Atwood is speaking about seems to be correct - there is a risk for alert clickjacking. So, one way to securely implement warning is just to notify user what he will be limited in. After all, in the sake of security, KISS-way method should be chosen for robust solution. –  anonymous Nov 22 '10 at 10:58
    
To clarify, what @Jeff was saying that if there is an option to cancel the alert, there is a risk of having that alert clickjacked, and thus having the entire framebusterbuster busted. That is to say, the alert is not just about being nice to users, its the only way to interfere with the busterbusterbuster. (I think I miscounted my busters... ) –  AviD Dec 11 '10 at 22:24

The solution I'd prefer as a user would be: Allow your site to be framed, but make sure malicious sites can do no harm. Don't continue the user's session from another tab if you are in a frame. Consider making the site read-only in this case. If you allow the user to re-login in the frame, display a warning. Of course this is a lot of work to implement for a rare use case, so it might not be practical.

If you really want to bust frames, I'd suggest an unobstrusive solution. Use the regular framebusting code, maybe in conjunction with the X-Frame-Options HTTP header, and provide a highlighted note on the page instead of a popup.


A sidenote: The HTML security model relies on the fact that one site cannot do things to other sites. This gives us the same-origin policy. A lot of hacks are based on bypassing this, by injecting code into other sites etc.. Clickjacking is related, but instead of using code to perform a function in the other site, the attacking page tricks the user into clicking somewhere.

Personally, I think the HTML security model, where servers trust the browser to keep scripts confined, is conceptually flawed. I'd prefer a model where code can do almost anything the user can, and instead you'd rely on security tokens instead. Sure, an attacking script could submit a form to delete a post, but without the right session id and password it would be ignored. This would allow much more interesting applications like mashups, client-only content aggregators, etc.. Of course it is too late to switch the web to such a security model now.

I'm writing this to motivate my advice: Even without relying on browser-enforced separation (e.g. framebusting) it's possible to write safe sites where every action is authorized by the user. Don't make your security rely on no-frames, but assume your site is framed, the SOP is compromised and the framing site can push buttons (with or without instrumentalizing the user).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.