How does Content-Security-Policy work with X-Frame-Options?

http http-headers content-security-policy x-frame-options
Yeldar Kurmangaliyev picture Yeldar Kurmangaliyev · Nov 2, 2016 · Viewed 49k times · Source

Does Content-Security-Policy ignore X-Frame-Options, returned by a server, or is X-Frame-Options still primary?

Assuming that I have:

  • a website http://a.com with X-Frame-Options: DENY
  • and a website http://b.com with Content-Security-Policy: frame-src a.com

will browser load this frame?

It is unclear.
On the one hand, http://a.com explicitly denies framing.
On the other hand, http://b.com explicitly allows framing for http://a.com.

Answer

Anand Bhat picture Anand Bhat · Nov 4, 2016

The frame-src CSP directive (which is deprecated and replaced by child-src) determines what sources can be used in a frame on a page.

The X-Frame-Options response header, on the other hand, determines what other pages can use that page in an iframe.

In your case, http://a.com with X-Frame-Options: DENY indicates that no other page can use it in a frame. It does not matter what http://b.com has in its CSP -- no page can use http://a.com in a frame.

The place where X-Frame-Options intersects with CSP is via the frame-ancestors directive. From the CSP specificiation (emphasis mine):

This directive is similar to the X-Frame-Options header that several user agents have implemented. The 'none' source expression is roughly equivalent to that header’s DENY, 'self' to SAMEORIGIN, and so on. The major difference is that many user agents implement SAMEORIGIN such that it only matches against the top-level document’s location. This directive checks each ancestor. If any ancestor doesn’t match, the load is cancelled. [RFC7034]

The frame-ancestors directive obsoletes the X-Frame-Options header. If a resource has both policies, the frame-ancestors policy SHOULD be enforced and the X-Frame-Options policy SHOULD be ignored.

An older question indicated this did not work in Firefox at that time but hopefully things have changed now.

UPDATE April 2018:

Content Security Policy: Directive ‘child-src’ has been deprecated. Please use directive ‘worker-src’ to control workers, or directive ‘frame-src’ to control frames respectively.

Looks like child-src is now the deprecated one and frame-src is back.

Related questions

application/x-www-form-urlencoded or multipart/form-data?

In HTTP there are two ways to POST data: application/x-www-form-urlencoded and multipart/form-data. I understand that most browsers are only able to upload files if multipart/form-data is used. Is there any additional guidance when to use one of …

Read More
How do we control web page caching, across all browsers?

Our investigations have shown us that not all browsers respect the HTTP cache directives in a uniform manner. For security reasons we do not want certain pages in our application to be cached, ever, by the web browser. This must …

Read More
Accessing the web page's HTTP Headers in JavaScript

How do I access a page's HTTP response headers via JavaScript? Related to this question, which was modified to ask about accessing two specific HTTP headers. Related: How do I access the HTTP request header fields via JavaScript?

Read More