prevent kill frame

Question

instead of asking how to kill frame. i interested to know what technique can be used to prevent an iframe inside a page from been killed by "frame killer"

Answer 1

Happily, there is nothing that works outside of Internet Explorer (which lets JS be disabled in iframes as a security feature).

If the author of a site doesn't want their pages framed, then that is their choice.

Answer 2

There is always, unfortunately a way to get round frame killers, because of the way they work. (The site that is being framed can usually, however, display a warning).

See Jeff Atwood's "disturbing revelation".

A few choice excerpt:

If an evil website decides it's going to frame your website, you will be framed. Period. Frame-busting is nothing more than a false sense of security; it doesn't work.

Frame busting code (from the linked Stack Overflow challenge):

<script type="text/javascript">
    var prevent_bust = 0  
    window.onbeforeunload = function() { prevent_bust++ }  
    setInterval(function() {  
      if (prevent_bust > 0) {  
        prevent_bust -= 2  
        window.top.location = 'http://server-which-responds-with-204.com'  
      }  
    }, 1)  
</script>

This code does the following:

• increments a counter every time the browser attempts to navigate away from the current page, via the window.onbeforeonload event handler

• sets up a timer that fires every millisecond via setInterval(), and if it sees the counter incremented, changes the current location to a server of the attacker's control

• that server serves up a page with HTTP status code 204, which does not cause the browser to nagivate anywhere

Answer 3

I don't get it. I tried to iframe a page with framekiller using the iframekiller killer as described (I put in in the head section of a blog, it just load up 'http://server-which-responds-with-204.com' all the time.

I even tried to make an empty blog (nothing in head and body) using blogger.com and replace 'server-which-responds-with-204' with it, it just load the empty blog.

Am I missing something here? What exactly am I suppose to do with http 204 thingy?