Re: [websec] Richard Barnes' Discuss on draft-ietf-websec-x-frame-options-09: (with DISCUSS and COMMENT)

[Tobias Gondrom <[e-mail]>]

On 19/08/13 21:31, Hill, Brad wrote:
> I received a question as to whether all browsers really implement the top-level only check, or if any do an immediate parent or ancestor walk.  I could guess, but I'd rather test.  Here's a test case for public use:
>
> http://webappsec-test.info/~bhill2/XFO/XFO_Top.html
>
> I checked the latest IE, Chrome, Opera and Firefox and they all render the innermost frame. (don't have a Safari instance handy at the moment to test but welcome others' reports)

I just tested Safari and can confirm that they do render the innermost
frame. (i.e. render based on the top-level frame.)

Strangely: I found in my old notes from the first version of the draft
from 2011/2012 that not all browsers would use the same algorithm for
X-Frame-Options: SAMEORIGIN. But obviously they do now (as tested and
verified).

I will adjust the text in version -11 for section 5 accordingly and
remove in section 5 sub-bullet a).

Special thanks to Brad for creating the test web page and cross-verifying.

Thanks, Tobias


Ps.: apologies, it may take up to 48 hours for me to submit the new text
for version-11 as I will have a busy work day tomorrow. :-(


>
> -Brad
> ________________________________________
> From: Hill, Brad
> Sent: Friday, August 16, 2013 4:44 PM
> To: Richard Barnes; The IESG
> Cc: [e-mail]; [e-mail]; [e-mail]
> Subject: RE: [websec] Richard Barnes' Discuss on        draft-ietf-websec-x-frame-options-09:   (with DISCUSS and COMMENT)
>
> Additional comments inline.
> ________________________________________
>
>
> (D3) Shouldn't ALLOW-FROM be followed by an origin, not a URI?  In other
> words, what does it mean to send "X-Frame-Options: ALLOW-FROM
> https://example.com/this/is/a/path?query#fragment"?
>
> [Hill, Brad] Agreed.
>
>
> (D3) In the ALLOW-FROM: what does "top level context" mean?  Do you
> really mean the top level here, as opposed to the next one up?  For
> example, suppose A loads B in an iframe, and B loads C, and then C sends
> an X-Frame-Options header with ALLOW-FROM.  Is the ALLOW-FROM origin
> compared to B or A?  In either case, you should also note the attacks
> that remain.  For example, if the answer is B, then B needs to use
> X-Frame-Options as well, or else, A can maliciously frame A within B.  Or
> if the answer is A, then C is trusting A not to load any malicious
> intermediate frames B.
>
> [Hill, Brad]  This really does mean the top/final origin value in a frame ancestor
> chain walk.  Browsers have implemented X-Frame-Options to check the
> Origin context that is topmost in the window or tab.  (the _top target,
> representing the full, original browsing context, not just the immediate
> parent frame)  This could be clarified perhaps, but is not incorrect.
>