CODEWITHSUNDEEP
same-origin-policyx-frame-optionsclickjacking
Johnathan Au
Johnathan Au

Reputation: 5362

Alternative to X-Frame-Options for IE7

I have been trying to make my application more secure by adding various features and one of them was to prevent click jacking. I have added the X-frame-options successfully to the response headers but after doing more research I have noticed that this options is not available in IE7. As such, what can I do for IE7 instead?

Upvotes: 3

Views: 535

Answers (1)

Alkema
Alkema

Reputation: 109

Best-available solution at the moment is to use JavaScript to break the frame. Of course it will not work if JavaScript is not enabled.

From OWASP:

First apply an ID to the style element itself:

<style id="antiClickjack">body{display:none !important;}</style>

And then delete that style by its ID immediately after in the script:

<script type="text/javascript">
   if (self === top) {
       var antiClickjack = document.getElementById("antiClickjack");
       antiClickjack.parentNode.removeChild(antiClickjack);
   } else {
       top.location = self.location;
   }
</script>

Source: https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet#Best-for-now_Legacy_Browser_Frame_Breaking_Script

Upvotes: 1

Related Questions