Browser Components: Frames

2024-09-17

字数统计: 447字 | 阅读时长≈ 2分

This Note contains:

Frames
Inline Frames (iframes)
- Security Issues with iframes
Frame-Busting Techniques
- Attacker Defeats Frame-Busting
- Defense Against Clickjacking

Frames

Old Days:
Frames were used primarily to organize webpage layouts but are now obsolete.

Example:

<HTML>
  <FRAMESET cols="20%, 80%">
    <FRAME src="http://cnn.com">
    <FRAME src="http://nytimes.com">
  </FRAMESET>
</HTML>

This format allowed different sections of the page to load from different URLs.

Purpose:
iframes embed another webpage into a sub-window on the current page. The parent page controls the size and position of the sub-window.
New Features in HTML5:
1. Seamless: The iframe inherits some styles from the parent page.
2. Sandbox:
  A security feature where iframe content is treated as originating from a unique domain, which restricts actions like:
  - Disabling forms and scripts
  - Disabling plugins
    (These restrictions can be relaxed using specific attributes, e.g., sandbox="allow-forms")
Example:
1
<iframe src="login.html" sandbox="allow-forms"></iframe>
Benefits of iframes:
- Modular design
- Isolated content: Useful for embedding ads or videos from other domains.

User Confusion:

The source of the iframe content is not clearly visible, which can mislead users:

The URL bar might show a trusted domain (e.g., trusted.com), but the iframe might load content from an untrusted source (e.g., ad.com).
Phishing example: A fake URL like www.paypa1.com could iframe actual PayPal content to trick users.

Phishing/Clickjacking Attacks:

Clickjacking: Attacker embeds the victim’s page into an iframe, tricking the user into interacting with it.
Cross-Origin Embedding: Many websites allow cross-origin embedding, which attackers can exploit.

Websites use JavaScript to detect and prevent their pages from being embedded in iframes. Example:

if (top != self) {
  top.location = self.location;
}
if (top.location != self.location) {
  parent.location = self.location;
}

Attackers can exploit iframe sandboxing options to disable frame-busting scripts, creating a fundamental security challenge:

Who to trust?
Both defenders and attackers can use iframes, making it difficult to determine trustworthy content.

X-Frame-Options Header:
This header tells the browser not to allow iframe embedding of your page.
Content Security Policy (CSP) - frame-ancestors:
Specifies allowed sources for embedding (or disables embedding entirely).
JavaScript Frame-Busting Scripts:
- Use well-established scripts for this; custom scripts may be vulnerable to attacks.
- Scripts should either prevent the page from being embedded or stop rendering if they cannot break from the iframe.

本文作者： Depasinre
本文链接： https:/Depasinre.github.io/2024/09/17/18636-Browser-Components-Frames/
版权声明： 本博客所有文章除特别声明外，均采用 MIT 许可协议。转载请注明出处！