Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Security implications of allowing framing?

I notice that when I try to access Stackoverflow through the reddit toolbar, I get a popup that says "For security reasons, framing is not allowed". See here for an example.

What exactly are those security reasons?

I realize that this might be a question for meta, but it is really more of a general web security question, so I'm giving it a shot here.

Thanks.

like image 803
jedberg Avatar asked Jan 23 '10 00:01

jedberg


1 Answers

You can check the story on that in here.

EDIT:

Ok, so quoting from the link the problem with framing is that it's the first step to clickjacking. How is that accomplished? You can have an apparently harmless page with links which have on top of it a frame with full transparency that was carefully positioned so that when you click the links of the page, you'll be clicking links or buttons of the framed page. Although you can't see the frame (due to full transparency), your clicks will be caught by it. This results in, while the user is lead to thinking that he's just navigating on a random page, he may be actually changing his twitter status, sending emails, doing something on facebook, clicking a paypall "Yes please donate it all" button, ... imagination is the limit.

like image 108
Miguel Ventura Avatar answered Oct 04 '22 23:10

Miguel Ventura