Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Bypassing iframe sandbox?

Tags:

Someone iframing my website, using

<iframe src="http://example.org" sandbox=""></iframe>  

This way, the sandbox attribute prevents my site to use iframe blocker on it. And it can be easily iframed.

Frame buster on my website:

if (window.top !== window.self) window.top.location.replace(window.self.location.href); 

Is there a programmatic way to redirect to my site when its being iframed when used with sandbox attribute ?

like image 988
user198989 Avatar asked Oct 30 '15 13:10

user198989


People also ask

How do I bypass iframe sandbox?

The best I can suggest would be to use the noscript tag to display a message to users seeing the page in a sandboxed iframe. You could style that so people can't see your content. Another person used with sandbox="allow-scripts" , so say that we can run javascript.

Is allow popups to escape sandbox safe?

allow-popups-to-escape-sandbox. Allows a sandboxed document to open new windows without forcing the sandboxing flags upon them. This will allow, for example, a third-party advertisement to be safely sandboxed without forcing the same restrictions upon the page the ad links to.


1 Answers

Iframing can be protected through the X-Frame-Options response header, set either X-Frame-Options value="DENY" or X-Frame-Options value="SAMEORIGIN". Through this response header settings you can protect your website against IFraming or clickjack attack.

Once X-Frame-Options response header is set, browser receives a standard message like "This content cannot be displayed in a frame".

like image 115
Sudipta Kumar Maiti Avatar answered Sep 25 '22 01:09

Sudipta Kumar Maiti