Add a guideline on framing protection #17
Conversation
wbamberg
changed the title
docs/security_guidelines.md
Outdated
|
|
||
| If you don't need your site to be embeddable in other sites, or if you need only certain specific sites to embed your site, implement framing protection using the [`frame-ancestors`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-ancestors) CSP directive and the [`X-Frame-Options`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options) HTTP response header. | ||
|
|
||
| The `frame-ancestors` directive offers more fine-grained control, allowing you to list sites that are allowed to embed your site. However, `X-Frame-Options` has better support in older browsers. Since browsers that support `frame-ancestors` will ignore `X-Frame-Options`, it is best to include both methods. |
There was a problem hiding this comment.
However,
X-Frame-Optionshas better support in older browsers.
Technically it's just IE that does XFO but not f-a, should we make that more clear? (To send a clearer message that f-a is supposed to be deprecating XFO and is the much much more preferred solution)
f-a should be a part of the CSP2 spec that is very well supported on, well, almost everything that should be out there today!
There was a problem hiding this comment.
It's not just IE, it's older browsers of any variety.
There was a problem hiding this comment.
I've adjusted it to include IE, link to caniuse, and strengthened the wording from "older" to "obsolete".
docs/security_guidelines.md
Outdated
|
|
||
| If you don't need your site to be embeddable in other sites, or if you need only certain specific sites to embed your site, implement framing protection using the [`frame-ancestors`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-ancestors) CSP directive and the [`X-Frame-Options`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options) HTTP response header. | ||
|
|
||
| The `frame-ancestors` directive offers more fine-grained control, allowing you to list sites that are allowed to embed your site. However, `X-Frame-Options` has better support in older browsers. Since browsers that support `frame-ancestors` will ignore `X-Frame-Options`, it is best to include both methods. |
There was a problem hiding this comment.
| The `frame-ancestors` directive offers more fine-grained control, allowing you to list sites that are allowed to embed your site. However, `X-Frame-Options` has better support in older browsers. Since browsers that support `frame-ancestors` will ignore `X-Frame-Options`, it is best to include both methods. | |
| The `frame-ancestors` directive offers more fine-grained control, allowing you to list sites that are allowed to embed your site. However, `X-Frame-Options` has better support in older browsers, so it is best to include both methods. Note that when both are provided, browsers which support `frame-ancestors` will prioritize `frame-ancestors` and ignore `X-Frame-Options`. |
suggestion for clarity
There was a problem hiding this comment.
Agree that it's helpful to say "when both are included" here and I have done that. To me "prioritise" implies that the non-prioritised thing may still get attention (i.e. priorities are relative) so I have not used that particular wording.
docs/security_guidelines.md
Outdated
|
|
||
| Controlling whether your site can be embedded in another site using an [`<iframe>`](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe) can help protect against [clickjacking](https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Clickjacking) and certain [cross-site leak attacks](https://xsleaks.dev/). | ||
|
|
||
| If you don't need your site to be embeddable in other sites, or if you need only certain specific sites to embed your site, implement framing protection using the [`frame-ancestors`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/frame-ancestors) CSP directive and the [`X-Frame-Options`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/X-Frame-Options) HTTP response header. |
There was a problem hiding this comment.
In most cases, you would not want a production site to be embeddable elsewhere, especially unknown origins. I suggest the default recommendation would be to restrict, and provide guidance for if a user needs the site to be embeddable, and to set the configuration as narrow as possible to only exactly what they need, to minimize risk.
Fixes #15.