1

From Yahoo News with an embedded TikTok posting:

"To protect your security, www.tiktok.com will not allow Firefox to display the page if another site has embedded it. To see this page, you need to open it in a new window."

Firefox explains it here

"Websites can use x-frame options or a content security policy to control if other websites may embed them on their own pages."

but doesn't offer any option except to display it in a new window.

The effect of this does seem absolutely minimal - I don't see any practical difference if the page is in a different window. But the suggestion of web browsers being ordered to display pages a certain way raises a big question: how are they being ordered to do things by anyone but the reader? (Do they really mean they're being advised and they actually think it's a good idea to avoid clickjacking but they're deflecting responsibility for that decision, or are goons going to come for them if they don't program it that way?)

4
  • 3
    The purpose is to defend against Clickjacking. See Wikipedia or imperva.com for more information on it. "how are they being ordered to do things by anyone but the reader?" - Do you seriously believe that the user is in full control of what happens on the page and also understands all of it in order to make an educated decision ? Sites also set cookie policies, CORS policies, CSP etc to protect the application and the user and X-Frame-Options is just one of these mechanisms. Feb 9, 2021 at 16:54
  • I understand sites make recommendations how to render content, from <br /> to <blink>. Cookie policies are usually ignored - they may expire in 2024, but my browser is set to delete them the moment I close it. But the Firefox page makes it sound like in this case they are not allowed to disregard that advice. That is the difference I seek to test here. Feb 9, 2021 at 17:47
  • 1
    Cookie policies are something like secure (send only over https), http (do not allow access from Javascript), samesite (can deny sending cookie cross-origin, protects against CSRF). CSP (Content Security Policy) is about restricting what the browser is allowed to do regarding including content or executing Javascript inline etc. These are all security measures browsers respect in the interest of the user - and X-Frame-Options serves exactly the same purpose. And none of these are just merely recommendations, these are instructions instead. Feb 9, 2021 at 17:56
  • you used to be able to frame w/o restriction. the embedded site would need to use framebusting js. you can block that with the sandbox attrib, but then (for reasons unknown to decent humans) browsers started supporting the non-standard X-Frame-Options header. Not even the <object> workaround works anymore.
    – dandavis
    Feb 9, 2021 at 20:28

2 Answers 2

2

I think this is a case where the website (server) and the web browser have a shared goal: to keep you safe.

Let's take a few unrelated examples of servers telling the browser how it's allowed to use the content that was served.

Content-Type

Let's say an API returns this in the HTTP body:

[
  {"keyA1":"valA", "keyB1":"valB"}
 ,{"keyA2":"valA", "keyB2":"valB"}
 ,{"keyA3":"valA", "keyB3":"valB"}
]

It turns out that this particular bit of data is both valid json and valid javascript. The browser has no way to tell what was intended unless it's given a hint. Historically this lead to security issues because attackers could bypass Same-Origin Policy by pointing a <script> tag at a json API that returned an array like that, the browser would happily execute that as javascript, thereby letting the attacker read the data.

This is a case where the server can give the browser some hints about how to currently use the response by setting the Content-Type: header to either

Content-Type: text/javascript

or

Content-Type: application/json

Is that a case of the server ordering the browser to do something? I suppose the browser could decide to ignore a Content-Type: application/json header and execute it as javascript, but why would it? Technically the user (more specifically a web page that the user loaded) asked the browser to do that, but it's almost certainly an attack and goes against the browser's goal of keeping you safe.


Cookies

Similar to the above, in a response from the server, it can push a cookie and flag it as HttpOnly. From the Mozilla docs:

Set-Cookie: <cookie-name>=<cookie-value>; HttpOnly

That flag basically means "Hello browser, please automatically staple this cookie onto any subsequent HTTP requests back to me, but do not allow javascript to read the cookie value". (the end-user can still view the value through browser dev tools)

Is that a case of the server ordering the browser to do something? I suppose the browser could ignore the HttpOnly flag, but the server is telling the browser that there is no legitimate (ie non-attack) reason to do so, so that goes against the browser's goal of keeping you safe.


Frame-ancestors

So now to your actual question.

"Websites can use x-frame options or a content security policy to control if other websites may embed them on their own pages."

Or the newer version of this, the frame-ancestors directive of the Content-Security-Policy header. The server is telling the browser under which circumstances it is legitimate behaviour to render this page inside a frame. As you say, if the browser fails to respect this, it could result in security issues for the end user, or security issues for the web site, or both. The browser wants to keep you secure, so it's in everybody's best interest for the browser to honour the web site's request. (Well, I guess it's not in the attacker's best interest, but we don't care about them).

-1

In displaying a site content, 3 parts are involved:

  • the site along with its developers and the tools developers
  • the browser and its developers
  • the final user

Both the site owner and the browser sponsor have a common interest: produce a nice look and feel to touch more clients. So there are a lot of exchanges between site tool developers and browser developers. As a result, the browser is much more obedient to the site than to the user. If the users paid important fees to the browser developers they could have more weight in decisions, but nowadays most browsers can be downloaded and used for free. The only points where user is seen as important are browser general ergonomy (look and feel), and security. The last point being mainly that if a browser was declared to allow too easily rogue accesses to the client machines, users would stop using it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .