Additional comments inline. ________________________________________
(D3) Shouldn't ALLOW-FROM be followed by an origin, not a URI? In other words, what does it mean to send "X-Frame-Options: ALLOW-FROM https://example.com/this/is/a/path?query#fragment";? [Hill, Brad] Agreed. (D3) In the ALLOW-FROM: what does "top level context" mean? Do you really mean the top level here, as opposed to the next one up? For example, suppose A loads B in an iframe, and B loads C, and then C sends an X-Frame-Options header with ALLOW-FROM. Is the ALLOW-FROM origin compared to B or A? In either case, you should also note the attacks that remain. For example, if the answer is B, then B needs to use X-Frame-Options as well, or else, A can maliciously frame A within B. Or if the answer is A, then C is trusting A not to load any malicious intermediate frames B. [Hill, Brad] This really does mean the top/final origin value in a frame ancestor chain walk. Browsers have implemented X-Frame-Options to check the Origin context that is topmost in the window or tab. (the _top target, representing the full, original browsing context, not just the immediate parent frame) This could be clarified perhaps, but is not incorrect. _______________________________________________ websec mailing list websec@ietf.org https://www.ietf.org/mailman/listinfo/websec
