3

Is there any way to bypass the x-frame-options header without using a MitM or changing the packets in another way?

So actually getting a site that has x-frame-options: DENY to be shown in an iframe.

5

There is one caveat when using X-Frame-Options header: it only checks the top level frame. This means that if you have nested frames, i.e. frames within frames, it is still possible for another origin to include a site with a X-Frame-Options: SAMEORIGIN header.

In this regard the header Content-Security-Policy: frame-ancestors 'self' is better, because it checks all frame ancestors.

frame within frame

  • Thanks for the answer, it is very clear. Just one question to clarify something: This only works in the same domain right? So from a different domain it would still be impossible to load the site in an iframe? – Wealot Mar 23 '17 at 7:08
  • @Arminius You are right. I was confusing DENY and SAMEORIGIN. The scenario I described is possible with SAMEORIGIN, not with DENY. – Sjoerd Mar 31 '17 at 12:24
1

So actually getting a site that has x-frame-options: DENY to be shown in an iframe.

It's not possible to embed a site sending an X-Frame-Options: DENY header in any frame.

From RFC 7034:

   DENY
      A browser receiving content with this header field MUST NOT
      display this content in any frame.

However, it might in some instances be possible to bypass the SAMEORIGIN directive as some browsers only check the top-level origin and not the direct frame parent:

   SAMEORIGIN
      A browser receiving content with this header field MUST NOT
      display this content in any frame from a page of different origin
      than the content itself. [...]

      Please note that current implementations vary on the
      interpretation of this criteria.  In some, it only allows a page
      to be framed if the origin of the top-level browsing context is
      identical to the origin of the content using the X-Frame-Options
      directive; in others, it may consider the origin of the framing
      page instead.

(Emphasis my own.)

  • Oops you are right I deleted my comment, thanks for your response :D This a good answer! :D – Wealot Mar 31 '17 at 12:47
  • Actually, it is possible - see my answer below. – niutech Jan 7 at 16:04
-1

It is possible to bypass X-Frame-Options: deny/sameorigin - have a look at my Web Component X-Frame-Bypass and the Hacker News demo.

  • Thanks for contributing. However, your answer is misleading. OP is asking about a bypass of the X-Frame-Options security mechanism. You are just downloading the content from elsewhere and then display it. This, of course, can't possibly be prevented. You don't actually bypass a security mechanism here. – Arminius Jan 7 at 17:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.