We are implementing clickjacking protection on our website as follows:

  1. By default every page on our site has frame-ancestors self
  2. We have a list of pages that are specifically designed to be embeddable in 3rd party apps, so those pages don't get frame-ancestors (or they get it with specific URLs configured by the customer)
  3. Our login page is non-configurable and can never be embedded.

One of our developers says he has a regression. His scenario includes an embeddable component that requires the user to be logged in, but it's embedded in a CMS that typically uses the same SSO as our product (so if the user got to the page, they are by definition logged in to the IDP).

His flow up until now was:

  1. Embed his page on an iframe
  2. His page redirects to our login page
  3. Our login page redirects to SAML
  4. SAML redirects to his page with Auth

Now he has a regression because our login page redirects with a frame-ancestors directive.

I think his flow is wrong and we're trying to solve it, but since it's already in production they are looking for a quick fix on the infrastructure side.

I was thinking of changing our logic so that we don't send the frame-ancestors on redirect. I feel like this should be safe, both because there shouldn't be any clickjacking on a page that wasn't loaded and because it seems like that's what the SAML IDP is doing (otherwise their flow would have failed a long time ago). On the other hand I couldn't find anyone talking about it anywhere, so I'm a bit worried that I'm missing something.

So basically my question is "Is it safe to not send frame-ancestors on my response if I'm responding with a redirect (e.g. 302)"?


You must log in to answer this question.

Browse other questions tagged .