What happens if browser doesn't support X-FRAME-OPTIONS?
Does it render the uri referenced by the iframe OR it doesn't render anything in this case?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
A browser that supports frames but not the
X-Frame-Options header (or the corresponding CSP policies) will simply render any frame content, regardless of the origin. It can't implement a security mechanism that it doesn't know about.
X-Frame-Options was implemented by most major browser around 2010 (and only later specified in RFC 7034 in year 2013) - at that time, frames have already long been around. Introducing the header was a reaction to the clickjacking problem that arised due to cross-origin frame embedding which couldn't be fully remediated with framebusting techniques.