draft-ietf-websec-x-frame-options-02.txt   draft-ietf-websec-x-frame-options-03.txt 
WEBSEC D. Ross WEBSEC D. Ross
Internet-Draft Microsoft Internet-Draft Microsoft
Intended status: Informational T. Gondrom Intended status: Informational T. Gondrom
Expires: August 29, 2013 Thames Stanley Expires: December 24, 2013 Thames Stanley
February 25, 2013 June 22, 2013
HTTP Header Field X-Frame-Options HTTP Header Field X-Frame-Options
draft-ietf-websec-x-frame-options-02 draft-ietf-websec-x-frame-options-03
Abstract Abstract
To improve the protection of web applications against Clickjacking, To improve the protection of web applications against Clickjacking,
this specification describes the X-Frame-Options HTTP response header this specification describes the X-Frame-Options HTTP response header
field that declares a policy communicated from the server to the field that declares a policy communicated from the server to the
client browser on whether the browser may display the transmitted client browser on whether the browser may display the transmitted
content in frames that are part of other web pages. This content in frames that are part of other web pages. This
informational document serves to document the existing use and informational document serves to document the existing use and
specification of this X-Frame-Options HTTP response header field. specification of this X-Frame-Options HTTP response header field.
Status of this Memo Status of This Memo
This Internet-Draft is submitted in full conformance with the This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79. provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on August 29, 2013. This Internet-Draft will expire on December 24, 2013.
Copyright Notice Copyright Notice
Copyright (c) 2013 IETF Trust and the persons identified as the Copyright (c) 2013 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License. described in the Simplified BSD License.
Table of Contents Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 3 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 3
2. X-Frame-Options Header . . . . . . . . . . . . . . . . . . . . 3 2. X-Frame-Options Header . . . . . . . . . . . . . . . . . . . 3
2.1. Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . 4 2.1. Syntax . . . . . . . . . . . . . . . . . . . . . . . . . 3
2.2. Augmented Backus-Naur Form (ABNF) . . . . . . . . . . . . 5 2.2. Augmented Backus-Naur Form (ABNF) . . . . . . . . . . . 4
2.2.1. Examples of X-Frame-Options . . . . . . . . . . . . . 5 2.2.1. Examples of X-Frame-Options . . . . . . . . . . . . . 5
2.2.2. Variations of the ALLOW-FROM field . . . . . . . . . . 5 2.3. Design Issues . . . . . . . . . . . . . . . . . . . . . . 5
2.3. Design Issues . . . . . . . . . . . . . . . . . . . . . . 5 2.3.1. Enable HTML content from other domains . . . . . . . 5
2.3.1. Enable HTML content from other domains . . . . . . . . 5 2.3.2. Browser Behaviour and Processing . . . . . . . . . . 5
2.3.2. Browser Behaviour and Processing . . . . . . . . . . . 6 2.3.2.1. Violation of X-Frame-Options . . . . . . . . . . 5
2.3.2.1. Violation of X-Frame-Options . . . . . . . . . . . 6 2.3.2.2. Variation in current browser behaviour . . . . . 6
2.3.2.2. Variation in current browser behaviour . . . . . . 6 2.3.2.3. Usage design pattern and example scenario for the
2.3.2.3. Usage design pattern and example scenario for ALLOW-FROM parameter . . . . . . . . . . . . . . 6
the ALLOW-FROM parameter . . . . . . . . . . . . . 7 3. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 7
3. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 7 4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7
4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8 4.1. Registration Template . . . . . . . . . . . . . . . . . . 7
4.1. Registration Template . . . . . . . . . . . . . . . . . . 8 5. Security Considerations . . . . . . . . . . . . . . . . . . . 8
5. Security Considerations . . . . . . . . . . . . . . . . . . . 8 5.1. Privacy Considreations . . . . . . . . . . . . . . . . . 8
5.1. Privacy Considreations . . . . . . . . . . . . . . . . . . 9 6. References . . . . . . . . . . . . . . . . . . . . . . . . . 8
6. References . . . . . . . . . . . . . . . . . . . . . . . . . . 9 6.1. Normative References . . . . . . . . . . . . . . . . . . 8
6.1. Normative References . . . . . . . . . . . . . . . . . . . 9 6.2. Informative References . . . . . . . . . . . . . . . . . 9
6.2. Informative References . . . . . . . . . . . . . . . . . . 9 Appendix A. Browsers that support X-Frame-Options . . . . . . . 9
Appendix A. Browsers that support X-Frame-Options . . . . . . . . 10 Appendix B. Description of a Clickjacking attack . . . . . . . . 10
Appendix B. Description of a Clickjacking attack . . . . . . . . 10 B.1. Shop . . . . . . . . . . . . . . . . . . . . . . . . . . 10
B.1. Shop . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 B.2. Online Shop Confirm Purchase Page . . . . . . . . . . . . 10
B.2. Online Shop Confirm Purchase Page . . . . . . . . . . . . 11 B.3. Flash Configuration . . . . . . . . . . . . . . . . . . . 10
B.3. Flash Configuration . . . . . . . . . . . . . . . . . . . 11 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 10
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . . 11
1. Introduction 1. Introduction
In 2009 and 2010 many browser vendors ([Microsoft-X-Frame-Options], In 2009 and 2010 many browser vendors ([Microsoft-X-Frame-Options],
[CLICK-DEFENSE-BLOG], [Mozilla-X-Frame-Options]) introduced the use [CLICK-DEFENSE-BLOG], [Mozilla-X-Frame-Options]) introduced the use
of a non-standard HTTP [RFC2616] header field "X-Frame-Options" to of a non-standard HTTP [RFC2616] header field "X-Frame-Options" to
protect against Clickjacking Clickjacking [Clickjacking]. HTML-based protect against Clickjacking Clickjacking [Clickjacking]. HTML-based
web applications can embed or "frame" other web pages. Clickjacking web applications can embed or "frame" other web pages. Clickjacking
is a type of attack that occurs when an attacker uses multiple is a type of attack that occurs when an attacker uses multiple
transparent or opaque layers in the user interface to trick a user transparent or opaque layers in the user interface to trick a user
into clicking on a button or link on another page from server B when into clicking on a button or link on another page from server B when
they were intending to click on the same place of the overlaying page they were intending to click on the same place of the overlaying page
from server A. Thus, the attacker is "hijacking" clicks meant for from server A. Thus, the attacker is "hijacking" clicks meant for
their page A and routing them to another page B, possibly belonging their page A and routing them to another page B, possibly belonging
to another domain and thereby triggering actions on the second server to another domain and thereby triggering actions on the second server
B without the knowledge nor intention of the user and potentially B without the knowledge nor intention of the user and potentially
using an existing session context and login in that step. using an existing session context and login in that step.
This specification provides informational documentation about the This specification provides informational documentation about the
current use and definition of the X-Frame-Options HTTP header field. current use and definition of the X-Frame-Options HTTP header field.
Given that the "X-" construction is deprecated [RFC6648], the Given that the "X-" construction is deprecated [RFC6648], the X
X-Frame-Options header field will in the future be replaced by the -Frame-Options header field will in the future be replaced by the
Frame-Options directive in the Content Security Policy Version 1.1 Frame-Options directive in the Content Security Policy Version 1.1
[CSP-1-1]. [CSP-1-1].
Existing anti-ClickJacking measures, e.g. Frame-breaking Javascript, Existing anti-ClickJacking measures, e.g. Frame-breaking Javascript,
have weaknesses so that their protection can be circumvented as a have weaknesses so that their protection can be circumvented as a
study [FRAME-BUSTING] demonstrated. study [FRAME-BUSTING] demonstrated.
Short of configuring the browser to disable frames and script Short of configuring the browser to disable frames and script
entirely, which massively impairs browser utility, browser users are entirely, which massively impairs browser utility, browser users are
vulnerable to this type of attack. vulnerable to this type of attack.
skipping to change at page 5, line 9 skipping to change at page 4, line 43
separator) is to be ignored. And the algorithm to compare origins separator) is to be ignored. And the algorithm to compare origins
from [RFC6454] SHOULD be used to verify that a referring page is of from [RFC6454] SHOULD be used to verify that a referring page is of
the same origin as the content or that the referring page's origin is the same origin as the content or that the referring page's origin is
identical with the ALLOW-FROM URI. Though in conflict with identical with the ALLOW-FROM URI. Though in conflict with
[RFC6454], current implementations do not consider the port as a [RFC6454], current implementations do not consider the port as a
defining component of the origin. defining component of the origin.
Wildcards or lists to declare multiple domains in one ALLOW-FROM Wildcards or lists to declare multiple domains in one ALLOW-FROM
statement are not permitted. statement are not permitted.
2.2. Augmented Backus-Naur Form (ABNF) 2.2. Augmented Backus-Naur Form (ABNF)
The RFC 2234 [RFC2234] ABNF of the X-Frame-Options header is: The RFC 5234 [RFC5234] ABNF of the X-Frame-Options header is:
X-Frame-Options = "DENY" X-Frame-Options = "DENY"
/ "SAMEORIGIN" / "SAMEORIGIN"
/ ( "ALLOW-FROM" RWS URI ) / ( "ALLOW-FROM" RWS URI )
With URI as defined in [RFC3986] and RWS and OWS as defined in With URI as defined in [RFC3986] and RWS and OWS as defined in
[HTTPbis-P1]. The values are specified as ABNF strings, and [HTTPbis-P1]. The values are specified as ABNF strings, and
therefore are case-insensitive. therefore are case-insensitive.
2.2.1. Examples of X-Frame-Options 2.2.1. Examples of X-Frame-Options
X-FRAME-OPTIONS: DENY X-FRAME-OPTIONS: DENY
X-FRAME-OPTIONS: SAMEORIGIN X-FRAME-OPTIONS: SAMEORIGIN
X-FRAME-OPTIONS: ALLOW-FROM https://example.com/ X-FRAME-OPTIONS: ALLOW-FROM https://example.com/
2.2.2. Variations of the ALLOW-FROM field
Regarding the syntax, it should be noted that existing
implementations have variations in whether a colon (":") should be
between "ALLOW-FROM" and the URI. E.g. in IE8+ the colon ":" is not
needed, while Firefox and Chrome implementations at the time of
writing of this document support both forms.
Alternative ABNF of the X-Frame-Options header:
X-Frame-Options = "DENY"
/ "SAMEORIGIN"
/ ( "ALLOW-FROM" OWS ":" OWS URI )
2.3. Design Issues 2.3. Design Issues
2.3.1. Enable HTML content from other domains 2.3.1. Enable HTML content from other domains
There are a number of main direct vectors that enable HTML content There are a number of main direct vectors that enable HTML content
from other domains: from other domains:
o IFRAME tag o IFRAME tag
o Frame tag o Frame tag
o The Object tag (requires a redirect) o The Object tag (requires a redirect)
o Applet tag o Applet tag
o Embed tag o Embed tag
Besides these, other ways to host HTML content can be possible. For Besides these, other ways to host HTML content can be possible. For
example some plugins may host HTML views directly. If these plugins example some plugins may host HTML views directly. If these plugins
skipping to change at page 9, line 23 skipping to change at page 8, line 44
6.1. Normative References 6.1. Normative References
[HTTPbis-P1] [HTTPbis-P1]
IETF, "Hypertext Transfer Protocol (HTTP/1.1): Message IETF, "Hypertext Transfer Protocol (HTTP/1.1): Message
Syntax and Routing", 2013, <http://tools.ietf.org/html/ Syntax and Routing", 2013, <http://tools.ietf.org/html/
draft-ietf-httpbis-p1-messaging-22>. draft-ietf-httpbis-p1-messaging-22>.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997. Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC2234] Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax
Specifications: ABNF", RFC 2234, November 1997.
[RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform [RFC3986] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
Resource Identifier (URI): Generic Syntax", STD 66, Resource Identifier (URI): Generic Syntax", STD 66, RFC
RFC 3986, January 2005. 3986, January 2005.
[RFC6454] Barth, A., "The Web Origin Concept", RFC 6454, [RFC5234] Crocker, D. and P. Overell, "Augmented BNF for Syntax
December 2011. Specifications: ABNF", STD 68, RFC 5234, January 2008.
[RFC6454] Barth, A., "The Web Origin Concept", RFC 6454, December
2011.
6.2. Informative References 6.2. Informative References
[CLICK-DEFENSE-BLOG] [CLICK-DEFENSE-BLOG]
Microsoft, "Clickjacking Defense", 2009, <http:// Microsoft, "Clickjacking Defense", 2009, <http://
blogs.msdn.com/b/ie/archive/2009/01/27/ blogs.msdn.com/b/ie/archive/2009/01/27/ie8-security-part-
ie8-security-part-vii-clickjacking-defenses.aspx>. vii-clickjacking-defenses.aspx>.
[CSP] W3C, "Content Security Policy 1.0", November 2012,
<http://www.w3.org/TR/CSP/>.
[CSP-1-1] W3C, "Content Security Policy 1.1", December 2012, [CSP-1-1] W3C, "Content Security Policy 1.1", December 2012,
<http://www.w3.org/TR/CSP11/>. <http://www.w3.org/TR/CSP11/>.
[CSP] W3C, "Content Security Policy 1.0", November 2012,
<http://www.w3.org/TR/CSP/>.
[Clickjacking] [Clickjacking]
OWASP (Open Web Application Security Project), OWASP (Open Web Application Security Project),
"Clickjacking", 2010, "Clickjacking", 2010,
<http://www.owasp.org/index.php/Clickjacking>. <http://www.owasp.org/index.php/Clickjacking>.
[FRAME-BUSTING] [FRAME-BUSTING]
Stanford Web Security Research, "Busting frame busting: a Stanford Web Security Research, "Busting frame busting: a
study of clickjacking vulnerabilities at popular sites", study of clickjacking vulnerabilities at popular sites",
2010, <http://seclab.stanford.edu/websec/framebusting/>. 2010, <http://seclab.stanford.edu/websec/framebusting/>.
[Microsoft-X-Frame-Options] [Microsoft-X-Frame-Options]
Microsoft, "Combating ClickJacking With X-Frame-Options", Microsoft, "Combating ClickJacking With X-Frame-Options",
2010, <http://blogs.msdn.com/b/ieinternals/archive/2010/ 2010, <http://blogs.msdn.com/b/ieinternals/archive/2010/03
03/30/combating-clickjacking-with-x-frame-options.aspx>. /30/combating-clickjacking-with-x-frame-options.aspx>.
[Mozilla-X-Frame-Options] [Mozilla-X-Frame-Options]
Mozilla, "The X-Frame-Options response header", 2010, <htt Mozilla, "The X-Frame-Options response header", 2010,
ps://developer.mozilla.org/en-US/docs/ <https://developer.mozilla.org/en-US/docs/The_X-FRAME-
The_X-FRAME-OPTIONS_response_header>. OPTIONS_response_header>.
[RFC2616] Fielding, R., Gettys, J., Mogul, J., Frystyk, H., [RFC2616] Fielding, R., Gettys, J., Mogul, J., Frystyk, H.,
Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext Masinter, L., Leach, P., and T. Berners-Lee, "Hypertext
Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999. Transfer Protocol -- HTTP/1.1", RFC 2616, June 1999.
[RFC3864] Klyne, G., Nottingham, M., and J. Mogul, "Registration [RFC3864] Klyne, G., Nottingham, M., and J. Mogul, "Registration
Procedures for Message Header Fields", BCP 90, RFC 3864, Procedures for Message Header Fields", BCP 90, RFC 3864,
September 2004. September 2004.
[RFC6648] Saint-Andre, P., Crocker, D., and M. Nottingham, [RFC6648] Saint-Andre, P., Crocker, D., and M. Nottingham,
skipping to change at page 11, line 26 skipping to change at page 10, line 42
For that reason, the confirmation page uses a combination of anti- For that reason, the confirmation page uses a combination of anti-
CSRF tokens and the X-FRAME-OPTIONS HTTP header field, mitigating CSRF tokens and the X-FRAME-OPTIONS HTTP header field, mitigating
ClickJacking attacks. ClickJacking attacks.
B.3. Flash Configuration B.3. Flash Configuration
Macromedia Flash configuration settings are set by a Flash object Macromedia Flash configuration settings are set by a Flash object
which can run only from a specific configuration page on Macromedia's which can run only from a specific configuration page on Macromedia's
site. The object runs inside the page and thus can be subject to a site. The object runs inside the page and thus can be subject to a
ClickJacking attack. In order to prevent ClickJacking attacks ClickJacking attack. In order to prevent ClickJacking attacks
against the security settings, the configuration page uses the against the security settings, the configuration page uses the X
X-FRAME-OPTIONS directive. -FRAME-OPTIONS directive.
Authors' Addresses Authors' Addresses
David Ross David Ross
Microsoft Microsoft
U.S. U.S.
Phone:
Email:
Tobias Gondrom Tobias Gondrom
Thames Stanley Thames Stanley
Kruegerstr. 5A Kruegerstr. 5A
Unterschleissheim, Unterschleissheim
Germany Germany
Phone: +44 7521003005 Phone: +44 7521003005
Email: tobias.gondrom@gondrom.org Email: tobias.gondrom@gondrom.org
 End of changes. 22 change blocks. 
78 lines changed or deleted 61 lines changed or added

This html diff was produced by rfcdiff 1.41. The latest version is available from http://tools.ietf.org/tools/rfcdiff/