I'm trying to understand when Framebusting should and shouldn't be used. At first brush I'd want to apply that to all pages in my site and generating exceptions as necessary.

On the other hand, if I were to take a minimalist approach, I would think I would want to apply this security to my login page.

  • Is there any reason why I shouldn't apply framebusting to a login page?

  • Are there any other related best practices?


From what I've seen Framebusting as a technique is becoming somewhat deprecated as a defence against click-jacking style attacks in favour of setting the X-Frame-Options header (e.g. the OWASP page here and here). Browser support for the X-Frame-Options headers seems to go back to IE8 so unless you have a really old set of browsers to support it should work ok.

So the short answer is that I'd recommend going down that line rather than using Framebusting Javascript.

  • So I should use X-Frame-Options on all pages in a site? ... likely starting at the login page? – goodguys_activate Feb 22 '13 at 16:11
  • I'd say so, If the site doesn't require frames at all then I'd see no downside to setting X-FRAME-OPTIONS 'DENY' for all pages. – Rоry McCune Feb 22 '13 at 16:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.