Unit 6: The browser security model · Lesson 4 of 5 · 16 min

Who may frame a page

Check which pages another site could load invisibly under a fake button.

mission

You are
The analyst reviewing the shop.
Situation
A support ticket links to a prize draw page that seems to sit on top of the shop's account page.
Goal
Find which shop pages can be framed by another site.
Hand in
A list of unprotected pages and the header that fixes them.

How a framed page is misused

0/3
visitorprize pageshop accountopens the drawinvisible iframeclick lands on Delete

Press play or step through.

01

Look at the lure

The lab browser is on the prize page. The dashed box marks where the invisible frame sits.

you should see A button placed exactly over the shop's account actions.

02

Check each shop page

Open /, /shop, /login and /account and look for X-Frame-Options or frame-ancestors in the response headers.

you should see Only one page refuses to be framed.

Framing protection

/account today
Cache-Control: no-store

Any site may frame it.

Fix
Content-Security-Policy: frame-ancestors 'none'
X-Frame-Options: DENY

The modern header, plus the old one for old browsers.

What a defender takes away

  1. 1Pages with buttons that change things must refuse to be framed.
  2. 2frame-ancestors in CSP is the modern control; X-Frame-Options covers older browsers.
  3. 3SameSite cookies help: a framed cross-site page may load signed out.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.