1632333 - The fix from Bug 1595652 only works for the first load

Status: RESOLVED WONTFIX

(Core :: DOM: Security, defect)

Description

[kernp25]

Attachment: E3tfjc9ZpS.mp4

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:75.0) Gecko/20100101 Firefox/75.0

Steps to reproduce:

1. Install the test add-on
2. Click on the icon

Actual results:

It will load the first page as expected. But if you navigate, then it will get blocked by the XFO.

Expected results:

Should also work for navigations.

Comment 1

[kernp25]

Attachment: manifest.zip

Comment 2

[Rob Wu [:robwu]]

We're not going to automatically lift the X-Frame-Options restrictions for extensions. You'll have to use the webRequest.onHeadersReceived API to remove the header (but make sure to check the details, including originUrl to make sure that you're only removing the XFO header for requests from your extension.