How to implement a frame buster?

views:

243

answers:

+2 Q:

How to implement a frame buster?

I'm searching for a guide that describes how to implement a working frame buster that also deals with people that dont have JS activated in their browser.

I read this very good question but i'm absolutely not interested in any advice like "dont do that yourself" or "maybe try...". i want to see a paper, with a step to step guide explaining every "why" (without maybe's and wihtout guesses). Academic papers prefered.

Can anyone post the link to the de-facto holy-grail paper of doing that?

thanks,

+6 A:

To be honest I think what you are describing is impossible. Correct me if i am wrong but this seems like a violation of the same origin policy. This is the "de-facto Holdy-Grail" paper of what browsers are allowed to do: http://code.google.com/p/browsersec/wiki/Main Make sure to read section 2.

*EDIT: ClickJacking is an attack that bypasses aspects of the same origin policy in un-patched web browsers. Trying to prevent all attacks that can come from unpatched browsers is a massive undertaking epically considering that person is most likely already hacked and apart of a BotNet. If you are really concerned about vulnerable web browsers I recommend blocking IE6 and below.

Rook 2010-02-19 17:52:46

+2 A:

On IE8 you have http://blogs.msdn.com/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx (So a site or a page that did not want to be iframe would set response header X-FRAME-OPTIONS: DENY). I also tested this with Firefox 3.5.x at some point and it worked.

Otherwise the linked page (http://coderrr.wordpress.com/2009/02/13/preventing-frame-busting-and-click-jacking-ui-redressing/) pretty accurately describes the issue and how many major sites deal with this today for some subset of their pages since a large number of users still are on IE6, etc.

mar 2010-02-19 19:20:24

This vulnerability affects web browsers and thats where the patch should be. Trying to stop every vulnerability that affects IE6 is a massive undertaking, especially because that person is probably a member of a botnet anyway. If you are really concerned just block IE6 users, most major sites are dropping support for them anyway.

Rook 2010-02-19 20:06:46

Won't disagree about IE6 users. For some sites on this specific issue:1) Site may decide users must have js enabled and so a solution that works across browsers *before* IE8 option is fine.2) Clickjacking is old and have not seen massive uptick because attackers continue to use phishing, XSS and along with malware remain more serious.3) Is Opt-in per page. If you have control over webserver you could add this by default to response header (is compat). Would like better soln from browsers. 4) Non 1E-8, Firefox 3.0+ form large %/no. and business do not want to forgo revenue from these users.

mar 2010-02-20 21:34:46

Adding to prev. comment. If not subject to constraints listed in my previous comment, make use of these options (in answer) and don't support IE6. I don't think IE7 or Safari support these options either.

mar 2010-02-20 21:44:18

ansaurus

tags:

views:

answers:

How to implement a frame buster?

related questions