Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

X-Frame-Options: DENY

Adding this HTTP header makes your site not work if embedded.



The embedding is more sophisticated than just an iframe or object tag. Generally they'll proxy the target site to their own origin and strip headers.


Could you not do a domain check of some kind in the JS payload and just document.write the entire thing with a bigass notice if it's not on your blessed domain?

You'd have to move the domain check in syntax and placement I guess, in an annoying game of cat and mouse... but it'd be something I suppose? Probably not worth it if it's not a large enough return.


Go read the article!

That is trivial to remove via proxying, which author mentioned them doing.

Really, anything you add to the page can be just removed that way. Only thing you can try is to somehow differentiate attacker traffic from normal users but with ubiquity of VPN providers good luck


> differentiate attacker traffic from normal users

Many ways to do just that, suggested in recent discussion:

https://news.ycombinator.com/item?id=33952114




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: