Re: [websec] Richard Barnes' Discuss on draft-ietf-websec-x-frame-options-09: (with DISCUSS and COMMENT)

["Hill, Brad" <[e-mail]>]

Additional comments inline.
________________________________________


(D3) Shouldn't ALLOW-FROM be followed by an origin, not a URI?  In other
words, what does it mean to send "X-Frame-Options: ALLOW-FROM
https://example.com/this/is/a/path?query#fragment"?

[Hill, Brad] Agreed.


(D3) In the ALLOW-FROM: what does "top level context" mean?  Do you
really mean the top level here, as opposed to the next one up?  For
example, suppose A loads B in an iframe, and B loads C, and then C sends
an X-Frame-Options header with ALLOW-FROM.  Is the ALLOW-FROM origin
compared to B or A?  In either case, you should also note the attacks
that remain.  For example, if the answer is B, then B needs to use
X-Frame-Options as well, or else, A can maliciously frame A within B.  Or
if the answer is A, then C is trusting A not to load any malicious
intermediate frames B.

[Hill, Brad]  This really does mean the top/final origin value in a frame ancestor
chain walk.  Browsers have implemented X-Frame-Options to check the 
Origin context that is topmost in the window or tab.  (the _top target, 
representing the full, original browsing context, not just the immediate 
parent frame)  This could be clarified perhaps, but is not incorrect.