797342 - assets.mozilla.org -missing recommended X-Frame-Options header

Status: RESOLVED FIXED

(Websites :: Other, defect)

Description

[Simon Bennetts [:psiinon]]

Issue: 
Missing recommended header X-Frame-Options

Steps to reproduce:
1) Browse http://assets.mozilla.org and https://assets-private.mozillalabs.com 
2) Examine the headers returned using a tool like OWASP ZAP

Remediation:
Set the HTTP header X-Frame-Options to DENY or SAMEORIGIN

Risk:
X-Frame-Options header is not included in the HTTP response to protect against 'ClickJacking' attacks
Most modern Web browsers support the X-Frame-Options HTTP header, ensure it's set on all web pages returned by your site (if you expect the page to be framed only by pages on your server (e.g. it's part of a FRAMESET) then you'll want to use SAMEORIGIN, otherwise if you never expect the page to be framed, you should use DENY.

Comment 1

[Adam Muntner [:adamm] (use NEEDINFO)]

It's been fixed somewhere along the way.

X-Frame-Options are set to "SAMEORIGIN, SAMEORIGIN"

Safari versions 5 and previous will misinterpret this and not be protected, but all modern browsers understand and will process correctly. "SAMEORIGIN" would be preferable but this is good enough. 


Closing the bug and removing Confidential flag

Comment 2

[April King [:April]]

I actually don't believe that is true.  I'm pretty sure that Firefox doesn't interpret "SAMEORIGIN, SAMEORIGIN" at all.  We should fix the config to remove the duplicate header.