X-Frame-Options ignored when using server push with multi-part responses
Announced
June 25, 2013
Reporter
Frédéric Buclin
Impact
Moderate
Products
Firefox, SeaMonkey
Fixed in
Firefox 22
SeaMonkey 2.19
Description
Bugzilla developer Frédéric Buclin reported
that the X-Frame-Options header is ignored when server push is used
in multi-part responses. This can lead to potential clickjacking on sites that
use X-Frame-Options as a protection.
Vulmon