Comments on: X-Frame-Options (Finally) on (Vanilla) Firefox

By: Giorgio

Giorgio — Mon, 11 Oct 2010 05:46:42 +0000

@KWierso:
Already “fixed” (more precisely, hacked away) in latest development build.

By: KWierso

KWierso — Mon, 11 Oct 2010 04:58:40 +0000

Huh. Seems like NoScript’s preventing Firefox 4’s addon manager’s "Get Addons" section from displaying, due to x-frame-options set on services.addons.mozilla.org.

Mozilla themselves had to work around this in bug 593387:
https://bugzilla.mozilla.org/show_bug.cgi?id=593387

By: Giorgio

Giorgio — Tue, 21 Sep 2010 19:45:20 +0000

@p0deje:
I’ll drop X-Frame-Options support when I’ll drop support for Firefox 3.6.x, which won’t probably happen for one year at least.

Regarding Origin, consensus on how it should work has formed only recently, and Firefox implementation is on its way, hence I’m not sure investing on it would be worth the effort.

By: p0deje

p0deje — Tue, 21 Sep 2010 17:37:53 +0000

Do you plan to drop X-Frame-Options support in future?
By the way, why there is no Origin HTTP header implementation in NoScript?

By: Anonymous Coward

Anonymous Coward — Tue, 31 Aug 2010 10:47:25 +0000

NoScript is always one step two years ahead :-)

By: Giorgio

Giorgio — Tue, 31 Aug 2010 07:09:59 +0000

@anon:
I’ve got no need to do it — yet.
If the point you want to make is that CSP is considerably more complex than X-Frame-Options, I agree, and this can actually hinder its adoption. But it’s obviously much more powerful, too.

By: anon

anon — Tue, 31 Aug 2010 03:55:34 +0000

try converting this site into CSP