News for hackers. Stuff that matters.
Re:HTTP Security headers you should be using by masklinn on Thursday January 23, 2014 @12:45PM (#7109712)
> 2. X-FRAME-OPTIONS

Please don't use that one everywhere, frame-based embedding is very useful in e.g. web-based feed reader (provides the original view of the site without having to go out of the reader and into a new tab).

Re:HTTP Security headers you should be using by relaxnow on Thursday January 23, 2014 @02:30PM (#7110557)
Unfortunately, as the web stands today, for our developers I do advocate including it by default, unless a specific use-case comes up to not include it.

While for a simple content page allowing for framing should be okay, the truth is very very few pages are actually purely content. As soon as you have something like a comment form there is a chance that framing it could be used to reveal some private information (autofill / password manager leakage). And who is going to manage what pages are framable and what aren't? The customer would need a UI and training and developers can't always see what will be hosted on a page.

Also, as an advertiser I would very much like you to visit the full page instead of trying to view it through some limited frame, cutting off the sidebar with ads.