draft-ietf-websec-x-frame-options-03.txt   draft-ietf-websec-x-frame-options-04.txt 
WEBSEC D. Ross WEBSEC D. Ross
Internet-Draft Microsoft Internet-Draft Microsoft
Intended status: Informational T. Gondrom Intended status: Informational T. Gondrom
Expires: December 24, 2013 Thames Stanley Expires: December 30, 2013 Thames Stanley
June 22, 2013 June 28, 2013
HTTP Header Field X-Frame-Options HTTP Header Field X-Frame-Options
draft-ietf-websec-x-frame-options-03 draft-ietf-websec-x-frame-options-04
Abstract Abstract
To improve the protection of web applications against Clickjacking, To improve the protection of web applications against Clickjacking,
this specification describes the X-Frame-Options HTTP response header this specification describes the X-Frame-Options HTTP response header
field that declares a policy communicated from the server to the field that declares a policy communicated from the server to the
client browser on whether the browser may display the transmitted client browser on whether the browser may display the transmitted
content in frames that are part of other web pages. This content in frames that are part of other web pages. This
informational document serves to document the existing use and informational document serves to document the existing use and
specification of this X-Frame-Options HTTP response header field. specification of this X-Frame-Options HTTP response header field.
skipping to change at page 1, line 37 skipping to change at page 1, line 37
Internet-Drafts are working documents of the Internet Engineering Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet- working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/. Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress." material or to cite them other than as "work in progress."
This Internet-Draft will expire on December 24, 2013. This Internet-Draft will expire on December 30, 2013.
Copyright Notice Copyright Notice
Copyright (c) 2013 IETF Trust and the persons identified as the Copyright (c) 2013 IETF Trust and the persons identified as the
document authors. All rights reserved. document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of (http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents publication of this document. Please review these documents
skipping to change at page 2, line 31 skipping to change at page 2, line 31
2.3.2.3. Usage design pattern and example scenario for the 2.3.2.3. Usage design pattern and example scenario for the
ALLOW-FROM parameter . . . . . . . . . . . . . . 6 ALLOW-FROM parameter . . . . . . . . . . . . . . 6
3. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 7 3. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 7
4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7 4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 7
4.1. Registration Template . . . . . . . . . . . . . . . . . . 7 4.1. Registration Template . . . . . . . . . . . . . . . . . . 7
5. Security Considerations . . . . . . . . . . . . . . . . . . . 8 5. Security Considerations . . . . . . . . . . . . . . . . . . . 8
5.1. Privacy Considreations . . . . . . . . . . . . . . . . . 8 5.1. Privacy Considreations . . . . . . . . . . . . . . . . . 8
6. References . . . . . . . . . . . . . . . . . . . . . . . . . 8 6. References . . . . . . . . . . . . . . . . . . . . . . . . . 8
6.1. Normative References . . . . . . . . . . . . . . . . . . 8 6.1. Normative References . . . . . . . . . . . . . . . . . . 8
6.2. Informative References . . . . . . . . . . . . . . . . . 9 6.2. Informative References . . . . . . . . . . . . . . . . . 9
Appendix A. Browsers that support X-Frame-Options . . . . . . . 9 Appendix A. Browsers that support X-Frame-Options . . . . . . . 10
Appendix B. Description of a Clickjacking attack . . . . . . . . 10 Appendix B. Description of a Clickjacking attack . . . . . . . . 10
B.1. Shop . . . . . . . . . . . . . . . . . . . . . . . . . . 10 B.1. Shop . . . . . . . . . . . . . . . . . . . . . . . . . . 10
B.2. Online Shop Confirm Purchase Page . . . . . . . . . . . . 10 B.2. Online Shop Confirm Purchase Page . . . . . . . . . . . . 10
B.3. Flash Configuration . . . . . . . . . . . . . . . . . . . 10 B.3. Flash Configuration . . . . . . . . . . . . . . . . . . . 10
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 10 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 11
1. Introduction 1. Introduction
In 2009 and 2010 many browser vendors ([Microsoft-X-Frame-Options], In 2009 and 2010 many browser vendors ([Microsoft-X-Frame-Options],
[CLICK-DEFENSE-BLOG], [Mozilla-X-Frame-Options]) introduced the use [CLICK-DEFENSE-BLOG], [Mozilla-X-Frame-Options]) introduced the use
of a non-standard HTTP [RFC2616] header field "X-Frame-Options" to of a non-standard HTTP [RFC2616] header field "X-Frame-Options" to
protect against Clickjacking Clickjacking [Clickjacking]. HTML-based protect against Clickjacking Clickjacking [Clickjacking]. HTML-based
web applications can embed or "frame" other web pages. Clickjacking web applications can embed or "frame" other web pages. Clickjacking
is a type of attack that occurs when an attacker uses multiple is a type of attack that occurs when an attacker uses multiple
transparent or opaque layers in the user interface to trick a user transparent or opaque layers in the user interface to trick a user
skipping to change at page 4, line 45 skipping to change at page 4, line 45
the same origin as the content or that the referring page's origin is the same origin as the content or that the referring page's origin is
identical with the ALLOW-FROM URI. Though in conflict with identical with the ALLOW-FROM URI. Though in conflict with
[RFC6454], current implementations do not consider the port as a [RFC6454], current implementations do not consider the port as a
defining component of the origin. defining component of the origin.
Wildcards or lists to declare multiple domains in one ALLOW-FROM Wildcards or lists to declare multiple domains in one ALLOW-FROM
statement are not permitted. statement are not permitted.
2.2. Augmented Backus-Naur Form (ABNF) 2.2. Augmented Backus-Naur Form (ABNF)
The RFC 5234 [RFC5234] ABNF of the X-Frame-Options header is: The RFC 5234 [RFC5234] ABNF of the X-Frame-Options header field value
is:
X-Frame-Options = "DENY" X-Frame-Options = "DENY"
/ "SAMEORIGIN" / "SAMEORIGIN"
/ ( "ALLOW-FROM" RWS URI ) / ( "ALLOW-FROM" RWS URI )
With URI as defined in [RFC3986] and RWS and OWS as defined in With URI as defined in [RFC3986] and RWS and OWS as defined in
[HTTPbis-P1]. The values are specified as ABNF strings, and [HTTPbis-P1]. The values are specified as ABNF strings, and
therefore are case-insensitive. therefore are case-insensitive.
2.2.1. Examples of X-Frame-Options 2.2.1. Examples of X-Frame-Options
skipping to change at page 9, line 12 skipping to change at page 9, line 12
[RFC6454] Barth, A., "The Web Origin Concept", RFC 6454, December [RFC6454] Barth, A., "The Web Origin Concept", RFC 6454, December
2011. 2011.
6.2. Informative References 6.2. Informative References
[CLICK-DEFENSE-BLOG] [CLICK-DEFENSE-BLOG]
Microsoft, "Clickjacking Defense", 2009, <http:// Microsoft, "Clickjacking Defense", 2009, <http://
blogs.msdn.com/b/ie/archive/2009/01/27/ie8-security-part- blogs.msdn.com/b/ie/archive/2009/01/27/ie8-security-part-
vii-clickjacking-defenses.aspx>. vii-clickjacking-defenses.aspx>.
[CSP-1-1] W3C, "Content Security Policy 1.1", December 2012, [CSP-1-1] Barth, A. and M. West, "Content Security Policy 1.1", W3C
<http://www.w3.org/TR/CSP11/>. Working Draft WD-CSP11-20130604, June 2013,
<http://www.w3.org/TR/2013/WD-CSP11-20130604/>.
[CSP] W3C, "Content Security Policy 1.0", November 2012, Latest version available at
<http://www.w3.org/TR/CSP/>.
[CSP] Sterne, B. and A. Barth, "Content Security Policy 1.0",
W3C Candidate Recommendation CR-CSP-20121115, November
2012, <http://www.w3.org/TR/2012/CR-CSP-20121115/>.
Latest version available at
[Clickjacking] [Clickjacking]
OWASP (Open Web Application Security Project), OWASP (Open Web Application Security Project),
"Clickjacking", 2010, "Clickjacking", 2010,
<http://www.owasp.org/index.php/Clickjacking>. <http://www.owasp.org/index.php/Clickjacking>.
[FRAME-BUSTING] [FRAME-BUSTING]
Stanford Web Security Research, "Busting frame busting: a Stanford Web Security Research, "Busting frame busting: a
study of clickjacking vulnerabilities at popular sites", study of clickjacking vulnerabilities at popular sites",
2010, <http://seclab.stanford.edu/websec/framebusting/>. 2010, <http://seclab.stanford.edu/websec/framebusting/>.
 End of changes. 8 change blocks. 
11 lines changed or deleted 18 lines changed or added

This html diff was produced by rfcdiff 1.41. The latest version is available from http://tools.ietf.org/tools/rfcdiff/