1025666 - Loads blocked by X-Frame-Options should result in an error page

Status: RESOLVED DUPLICATE of bug 631853

(Core :: DOM: Navigation, defect)

Description

[Andreas]

User Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:30.0) Gecko/20100101 Firefox/30.0 (Beta/Release)
Build ID: 20140608211828

Steps to reproduce:

Embedded a Page in an iframe from another URL, where X-Frame is SAMEORIGIN.

=> The Page should not be displayed because of security Reasons


Actual results:

Firefox displayes only a white Frame, only in Firebug a message is printed.


Expected results:

Firefox should display a Page like "Server not found", e.g.

"This page cannot be displyed in a Frame because of Security Reasons"
Maybe some details
Button: [Open this Frame in a new Tab]

Comment 1

[Paul Silaghi, QA [:pauly]]

Could you please provide a minimal testcase?

Comment 2

[Andreas]

Attachment: Testcase with an Iframe

Testcase, in the First iframe is not displayed, because the Yahoo Server does not allow it.

Firefox displays nothing, only in Firebug I can see the reason.

Comment 3

[Andreas]

Download the example, now nothing is displayed because the Ifreame is a HTTP connection, and the Main page a HTTPS connection.

May this can also be fixed, should be in the same code range.

Also display an error, so the user sees also only a white frame...

Comment 4

[Boris Zbarsky [:bzbarsky]]

This is basically asking for an error page for the case when X-Frame-Options denies a load.  That seems perfectly sensible, and http://tools.ietf.org/html/draft-ietf-websec-x-frame-options-00#section-2.3.2 suggests it as well.

Like most error pages, this probably needs UX input.

Comment 5

[Markus Keller]

Dup of bug 631853 and bug 561916.

Comment 6

[Boris Zbarsky [:bzbarsky]]

Markus, thanks!