I've noticed that one of my web-sites shows up pretty much blank when viewed from Google Cache at webcache.googleusercontent.com, because Google apparently must be inserting the following extra header, which, apparently, makes SeaMonkey not display whichever content is supplied through an iframe (which I'm using as the HTML5 equivalent of the deprecated frameset):

X-XSS-Protection: 1; mode=block

X-Frame-Options: SAMEORIGIN

What's exactly the attack surface here? Isn't Google Cache already supposed to include user content?

Has it just been included without much thought, or is there a genuine attack surface here?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.