Subject: [websec] Frame-Options: Why a header and not a CSP directive?

From: Adam Barth <[email-masked]>
Date: Thu, 3 May 2012 16:58:58 -0700

In http://tools.ietf.org/html/draft-gondrom-frame-options-02 we're
introducing a new HTTP header called Frame-Options.  Is there a
particular reason to create yet-another-HTTP-header for carrying this
security policy?  Rather than inventing a new HTTP header, we can use
the extensible Content-Security-Policy header.

== Proposed in draft-gondrom-frame-options ==

Frame-Options: XYZ

Where XYZ is the Frame-Options policy.

== Using Content-Security-Policy ==

Content-Security-Policy: frame-options XYZ

There are added benefits to using a common policy header.  For
example, Content-Security-Policy has a report-uri directive that web
sites can use to learn when their security policies are violated:

Content-Security-Policy: frame-options XYZ; report-uri /csp-reports.cgi

Note: Content-Security-Policy 1.0 is very close to WGLC in the W3C
WebAppSec working group.  You can find the current draft  at
<http://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html>.

The WebAppSec working group is soliciting proposals for CSP 1.1:

http://www.w3.org/Security/wiki/Content_Security_Policy#Proposals_for_Version_1.1

In particular, we have an item on the wiki about coordinating with
this working group about frame-options.  It's entirely possible to
define the frame-options directive in this working group and to have
CSP 1.1 refer to whatever document this working group produces.  In
the long term, we'll probably want an IANA registry for CSP
directives, but we haven't quite reached that level of technology yet.
 :)

Kind regards,
Adam

---

From: Julian Reschke <[email-masked]>
Date: Fri, 04 May 2012 09:11:48 +0200

On 2012-05-04 01:58, Adam Barth wrote:
> ...

Well, the header field already exists as "x-frame-options", so the only 
thing new here is that there's a spec, and that it's promoting a 
prefix-less name.

I have no opinion on whether it should be a CSP directive, but a goal 
should be to document what's out there, even if we don't like it. In 
*particular* if it is related to security, and used in practice.

Best regards, Julian

---

From: Adam Barth <[email-masked]>
Date: Fri, 4 May 2012 09:50:01 -0700

On Fri, May 4, 2012 at 12:11 AM, Julian Reschke <[email-masked]> wrote:
> thing new here is that there's a spec, and that it's promoting a prefix-less
> name.
>
> I have no opinion on whether it should be a CSP directive, but a goal should
> be to document what's out there, even if we don't like it. In *particular*
> if it is related to security, and used in practice.

Yes, I agree that we should document the existing X-Frame-Options
header.  However, the Frame-Options header doesn't yet exist.  Rather
than introduce it, I wonder if we'd be better off making the
"unprefixed" version a CSP directive rather than an HTTP header.

Adam