title: X-Frame-Options: ALLOW-FROM in firefox and chrome
body: <p>I'm implementing a &quot;pass-through&quot; for <code>X-Frame-Options</code> to let a partner site wrap my employer's site in an iframe, as per this article: <a href="http://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx" rel="nofollow noreferrer">http://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx</a></p>
  <p>(splitting up URLS to post)</p>
  <p>In a nutshell, our partner's page has an iframe with an URL against our domain.
  For any page in our domain, they'll add a special url argument like <code>&amp;@mykey=topleveldomain.com</code>, telling us what the page's top level domain is.</p>
  <p>Our filters pick up the partner TLD, if provided, from the URL, and validate it against a whitelist.  If it's on the list, we ship the <code>X-Frame-Options</code> header with value <code>ALLOW-FROM topleveldomain.com</code> (and add a cookie for future clicks).  If it's not on our whitelist, we ship <code>SAMEORIGIN</code> or <code>DENY</code>.</p>
  <p>The problem is it looks like sending <code>ALLOW-FROM domain</code> results in a no-op overall for the latest Firefox and Google Chrome.  IE8, at least, seems to be correctly implementing <code>ALLOW-FROM</code>.</p>
  <p>Check out this page:  <a href="http://www.enhanceie.com/test/clickjack" rel="nofollow noreferrer">http://www.enhanceie.com/test/clickjack</a>.  Right after the 5th (of 5) boxes that &quot;should be showing content&quot;, is a box that should NOT be showing content, but which is.  In this case, the page in the iframe is sending <code>X-Frame-Options: ALLOW-FROM http://www.debugtheweb.com</code>, a decidedly different TLD than <code>http://www.enhanceie.com</code>.  Yet, the frame still displays content.</p>
  <p>Any insight as to whether <code>X-Frame-Options</code> is truly implemented with <code>ALLOW-FROM</code> across relevant (desktop) browsers?  Perhaps the syntax has changed?</p>
  <p>Some links of interest:</p>
  <ul>
  <li>Draft rfc on x-frame-options: <a href="https://datatracker.ietf.org/doc/html/draft-gondrom-frame-options-01" rel="nofollow noreferrer">https://datatracker.ietf.org/doc/html/draft-gondrom-frame-options-01</a></li>
  <li>developer.mozilla article discussing the header as a 2-option header (sameorigin or deny).  <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options" rel="nofollow noreferrer">https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options</a></li>
  <li>msdn blog that initiated the whole thing: <a href="http://blogs.msdn.com/b/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx" rel="nofollow noreferrer">http://blogs.msdn.com/b/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx</a></li>
  <li>msdn blog that talks about 3 values: adding allow-from origin <a href="http://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx" rel="nofollow noreferrer">http://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx</a></li>
  </ul>