1

I found various discussions about https being embedded in iframes for various reasons. I tested it and saw that one bank site escapes the iframe and the other allows being embedded in an iframe.

Google, for example, just does not load in an iframe. Drupal, as a cmd doesn't seem that CMS's have such a functionality built in.

Is there a down side to using framekiller code or scripts to avoid click jacking and other types of attacks on one's site?

Would it not be good practice to do this in general?

1

Is there a down side to using framekiller code or scripts to avoid click jacking and other types of attacks on one's site?

I think there could be two main downsides for framekillers:

  • If JavaScript is disabled (by the victim, or if the attacker succeeded to perform that on a victim) then your page is no longer protected against clickjacking
  • What if a user wants to visit your website using his phone? Phones do not have much resources and are known to be slower than ordinary machines (computers) to deal with heavy webpaes (I mean loading JavaScript/AJAX)

Would it not be good practice to do this in general?

Why not to resolve this problem of clickjacking on the server side by using X-Frame-Options?

1

Generally it's always worth having, or rather it doesn't hurt and can prevent clickjacking attacks.

Of course it does depend on your usage scenario though. For example if the content you are creating needs to be displayed in an iframe (perhaps an advertising network) then you probably don't want to break out of the frame.

A good resource to read on the various approaches to implementing this can be found here.

One other thing to bear in mind that it can give a false sense of security somewhat, it's a bit of a cat and mouse game with regards to clickjacking attacks and defensive measures. Adding well implemented clickjacking protection to your site is great and definitely worth doing, but you'll need to review it periodically to ensure that it's still fit for purpose, like everything else when it comes to security :)

EDIT

Just wanted to clarify that clickjacking defense should include both X-Frame-Options and a bit of javascript for older browsers which do not support X-Frame-Options headers. The javascript layer of the defense has several limitations though which are also disccused on this page.

  • 1
    I wish I could find the article about framekiller scripts where someone claimed (in the comments) that some (all?) of these scripts open a door to XSS attacks. I would argue that if google is doing it as a standard, XSS should not be an issue for their implementation. Now to check how they do it ... – NamSandStorm Oct 20 '15 at 10:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.