WEBSEC D. Ross
Internet-Draft Microsoft
Intended status: Informational T. Gondrom
Expires: February 28, 2014 Thames Stanley
August 27, 2013
HTTP Header Field X-Frame-Options
draft-ietf-websec-x-frame-options-11
Abstract
To improve the protection of web applications against Clickjacking,
this definition describes the X-Frame-Options HTTP response header
field that declares a policy communicated from the server to the
client browser on whether the browser may display the transmitted
content in frames that are part of other web pages. This
informational document serves to document the existing use and
specification of this X-Frame-Options HTTP response header field.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on February 28, 2014.
Copyright Notice
Copyright (c) 2013 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
Ross & Gondrom Expires February 28, 2014 [Page 1]
Internet-Draft X-Frame-Options August 2013
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3
2. X-Frame-Options Header . . . . . . . . . . . . . . . . . . . 3
2.1. Syntax . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.2. Augmented Backus-Naur Form (ABNF) . . . . . . . . . . . 5
2.2.1. Examples of X-Frame-Options . . . . . . . . . . . . . 5
2.3. Design Issues . . . . . . . . . . . . . . . . . . . . . . 5
2.3.1. Enable HTML content from other domains . . . . . . . 6
2.3.2. Browser Behaviour and Processing . . . . . . . . . . 6
2.3.2.1. Violation of X-Frame-Options . . . . . . . . . . 6
2.3.2.2. Variation in current browser behaviour . . . . . 6
2.3.2.3. Usage design pattern and example scenario for the
ALLOW-FROM parameter . . . . . . . . . . . . . . 8
2.3.2.4. No caching of the X-Frame-Options header . . . . 8
3. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 9
4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 9
4.1. Registration Template . . . . . . . . . . . . . . . . . . 9
5. Security Considerations . . . . . . . . . . . . . . . . . . . 9
5.1. Privacy Considerations . . . . . . . . . . . . . . . . . 10
6. References . . . . . . . . . . . . . . . . . . . . . . . . . 10
6.1. Normative References . . . . . . . . . . . . . . . . . . 10
6.2. Informative References . . . . . . . . . . . . . . . . . 11
Appendix A. Browsers that support X-Frame-Options . . . . . . . 12
Appendix B. Description of a Clickjacking attack . . . . . . . . 12
B.1. Shop . . . . . . . . . . . . . . . . . . . . . . . . . . 12
B.2. Online Shop Confirm Purchase Page . . . . . . . . . . . . 12
B.3. Flash Configuration . . . . . . . . . . . . . . . . . . . 13
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 13
1. Introduction
In 2009 and 2010 many browser vendors ([Microsoft-X-Frame-Options],
[CLICK-DEFENSE-BLOG], [Mozilla-X-Frame-Options]) introduced the use
of a non-standard HTTP [RFC2616] header field "X-Frame-Options" to
protect against Clickjacking [Clickjacking]. HTML-based web
applications can embed or "frame" other web pages. Clickjacking is a
type of attack that occurs when an attacker uses multiple transparent
or opaque layers in the user interface to trick a user into clicking
on a button or link on another page from server B when they were
intending to click on the same place of the overlaying page from
server A. Thus, the attacker is "hijacking" clicks meant for their
page A and routing them to another page B. The attacker is tricking
Ross & Gondrom Expires February 28, 2014 [Page 2]
Internet-Draft X-Frame-Options August 2013
the user (who sees the overlaying user interface content from page A)
into clicking specific locations on the underlying page from server
B, triggering some actions on server B and potentially using an
existing session context in that step. This is an attack on both the
user and on server B. And server A may or may not be the attacker.
This specification provides informational documentation about the
current use and definition of the X-Frame-Options HTTP header field.
As described in Section 2.3.2.2 not all browsers implement X-Frame-
Options exactly in the sames way, which can lead to unintended
results. And given that the "X-" construction is deprecated
[RFC6648], the X-Frame-Options header field will in the future be
replaced by the Frame-Options directive in the Content Security
Policy Version 1.1 [CSP-1-1].
Existing anti-ClickJacking measures, e.g. Frame-breaking Javascript,
have weaknesses so that their protection can be circumvented as a
study [FRAME-BUSTING] demonstrated.
Short of configuring the browser to disable frames and script
entirely, which massively impairs browser utility, browser users are
vulnerable to this type of attack.
"X-Frame-Options" allows a web page from host B to declare that its
content (for example a button, links, text, etc.) must not be
displayed in a frame ( or