What happens if browser doesn't support X-FRAME-OPTIONS?

Does it render the uri referenced by the iframe OR it doesn't render anything in this case?


A browser that supports frames but not the X-Frame-Options header (or the corresponding CSP policies) will simply render any frame content, regardless of the origin. It can't implement a security mechanism that it doesn't know about.

X-Frame-Options was implemented by most major browser around 2010 (and only later specified in RFC 7034 in year 2013) - at that time, frames have already long been around. Introducing the header was a reaction to the clickjacking problem that arised due to cross-origin frame embedding which couldn't be fully remediated with framebusting techniques.

  • Thx Aminius, can you please back your answer by a reference? Then I will accept the answer. – Amio.io Mar 11 '17 at 20:07
  • He is right. Why dont you just test it? People dont write documentation in their browsers for nonexistant features. – joe Mar 11 '17 at 20:15
  • 1
    @zatziky I'm not sure about what references you're looking for. X-Frame-Options came after the frame technology, so obviously a browser that doesn't know about the header would just ignore it. – Arminius Mar 11 '17 at 20:30
  • @Arminius Thx, it helps me to understand when I read it in other words and other thoughts. – Amio.io Mar 11 '17 at 20:33
  • @zatziky The linked RFC has a little bit of historical background if you're interested. – Arminius Mar 11 '17 at 20:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.