Web Agent X-Frame-Options introduced and explanations
search cancel

Web Agent X-Frame-Options introduced and explanations

book

Article ID: 57358

calendar_today

Updated On: 10-17-2023

Products

CA Single Sign On Secure Proxy Server (SiteMinder) CA Single Sign On SOA Security Manager (SiteMinder) CA Single Sign-On SITEMINDER CA Single Sign On Agents (SiteMinder)

Issue/Introduction

 

  - What is X-Frame-Options response header? What is the implication
    of setting it ?
  - What are the different options for X-Frame-Options response
    header ?
  - What are the other considerations ?
  - Does Single Sign-On Web Agent have support for X-Frame-Options
    response header ?

 

Environment

Version : R12.8.6a

Resolution

 

The X-Frame-Options HTTP response header can be used to indicate
whether or not a browser should be allowed to render a page in a
<frame> or <iframe>. Sites can use this to avoid Clickjacking attacks,
by ensuring that their content is not embedded into other sites
(1)(2)(3).

X-Frame-Options Header Types

There are three possible values for the X-Frame-Options header:

 - DENY : which prevents any domain from framing the content. The
          "DENY" setting is recommended unless a specific need has been
          identified for framing.
 
 - SAMEORIGIN : which only allows the current site to frame the
                content.

 - ALLOW-FROM uri : which permits the specified 'uri' to frame this
                    page. (e.g., ALLOW-FROM http://www.example.com)
   
Browser Support

The following browsers support X-Frame-Options headers.

  | Browser           | DENY/SAMEORIGIN Support Introduced | ALLOW-FROM Support Introduced   |
  |-------------------+------------------------------------+---------------------------------|
  | Chrome            | 4.1.249.1042 (4)                   | Not supported/Bug reported (5)  |
  | Firefox (Gecko)   | 3.6.9 (1.9.2.9) (6)                | 18.0 (7)                        |
  | Internet Explorer | 8.0 (8)                            | 9.0 (9)                         |
  | Opera             | 10.50                              |                                 |
  | Safari            | 4.0 (10)                           | Not supported/Bug reported (11) |

Note :

X-Frame-Options Deprecated While the X-Frame-Options header is
supported by the major browsers, it was never standardized and has
been deprecated in favour of the frame-ancestors directive from the
CSP Level 2 specification.

Single Sign-on Web Agent support for X-Frame-Options

Single Sign-on Web Agent r12.5 (as of CR5) does not have support for
XFrameOptions ACO Parameter.

It also drops the X-Frame-Options header even if the header is set
from the Web Server directly.

For e.g To configure Apache to send the X-Frame-Options header for all
pages, you will add following configuration to your site's
configuration (httpd.conf):

   Header always append X-Frame-Options SAMEORIGIN

However, even when you have this, if the WebSite is protected by
SiteMinder web agent, it drops this header from reaching to the
client/browser.

In other words, Single Sign-on Web Agent doesn't honor the web-server
setting for X-Frame-Options.

Single Sign-on Web Agent r12.51 CR4 and above does have support for
XFrameOptions ACO Parameter.

The options for the XFrameOptions parameter are the same as the values
for the X-Frame-Options response header:

   Options: DENY, SAMEORIGIN, ALLOW-FROM uri

r12.51 CR4 and above Web Agent, also do honor this header if it is
being set by the WebServer itself and let the header pass to the
client/browser.

 

Additional Information

 

(1)

    Clickjacking Defense Cheat Sheet - OWASP
    https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet#X-Frame-Options_Header_Types

(2)

    The X-Frame-Options response header - HTTP | MDN
    https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options

(3)

    Help Prevent Attacks
    https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/siteminder/12-52-01/configuring/web-agent-configuration/user-protection-and-tracking/help-prevent-attacks.html

(4)

    Security in Depth: New Security Features
    http://blog.chromium.org/2010/01/security-in-depth-new-security-features.html

(5)

    Issue 129139: Chrome not support Allow-From in X-Frame-Options header
    https://code.google.com/p/chromium/issues/detail?id=129139

(6)

    X-Frame-Options
    https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options?redirectlocale=en-US&redirectslug=The_X-FRAME-OPTIONS_response_header
    

(7)

    Implement Allow-From syntax for X-Frame-Options
    https://bugzilla.mozilla.org/show_bug.cgi?id=690168
    

(8)

    Clickjacking Defense in IE8
    https://www.microsoft.com/security/blog/2009/02/05/clickjacking-defense-in-ie8/

(9)

   X-Frame-Options Compatibility Test
   http://erlend.oftedal.no/blog/tools/xframeoptions/

(10)

   Apple Safari jumbo patch: 50+ vulnerabilities fixed
   http://www.zdnet.com/blog/security/apple-safari-jumbo-patch-50-vulnerabilities-fixed/3541
   

(11)

   Bug 94836 - Support for X-Frame-Options: Allow-From [uri]
   https://bugs.webkit.org/show_bug.cgi?id=94836