Closed Bug 1178037 Opened 9 years ago Closed 9 years ago

clickjacking in marketplace.firefox.com

Categories

(Marketplace Graveyard :: General, defect)

Product:
Marketplace Graveyard
Component:
General
Version:
Avenir
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

(Not tracked)

Status:
RESOLVED DUPLICATE of bug 872531

People

(Reporter: ignatio2007, Unassigned)

Details

(Whiteboard: [ktlo]) 

How to reproduce:

1. logged in https://marketplace.firefox.com/
2. go to poc script http://bin-bon.narod.ru/1112123231221323123121312.html
3. maybe to drag text to other frame or delete app

look at attchment
XFO header was removed in 2013.  This is a dupe of bug 872531
Yeah, this is a dupe of that bug.  If it were possible to put the packaged app origin into the ALLOW_FROM parameter we might be able to use x-frame-options.
Whiteboard: [ktlo]
Status: UNCONFIRMED → RESOLVED
Closed: 9 years ago
Resolution: --- → DUPLICATE
(In reply to Wil Clouser [:clouserw] from comment #2)
> Yeah, this is a dupe of that bug.  If it were possible to put the packaged
> app origin into the ALLOW_FROM parameter we might be able to use
> x-frame-options.

Why can't the site send the header unless the UserAgent is a FxOS device?
Flags: needinfo?(wclouser)
Flags: needinfo?(wclouser)
You need to log in before you can comment on or make changes to this bug.