You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@myfaces.apache.org by "Gabrielle Crawford (Created) (JIRA)" <de...@myfaces.apache.org> on 2011/11/22 02:10:40 UTC
[jira] [Created] (TRINIDAD-2169) add framebusting support to handle
clickjacking attacks
add framebusting support to handle clickjacking attacks
-------------------------------------------------------
Key: TRINIDAD-2169
URL: https://issues.apache.org/jira/browse/TRINIDAD-2169
Project: MyFaces Trinidad
Issue Type: Bug
Reporter: Gabrielle Crawford
First you need to understand clickjacking, which is a security issue when using frames (meaning a frame or iframe). Here's some sites that explain it
http://en.wikipedia.org/wiki/Clickjacking
http://www.imperva.com/resources/glossary/clickjacking_ui-redressing.html
http://seclab.stanford.edu/websec/framebusting/framebust.pdf
With framebusting we would have support so that an app can say whether its pages are allowed to run in a frame. This will be controlled with a new context parameter "org.apache.myfaces.trinidad.security.FRAME_BUSTING". Values are:
1. always: always bust frames, meaning don't allow a page to be embedded in frames
2. never: never bust frames, meaning always allow a page to be embedded in frames
3. differentOrigin: only bust frames if the an ancestor window origin (protocol, host, and port) and the frame origin are different.
If the ancestor windows and frame have the same origin then allow the content to run in a frame.
For more infomation on origins see http://en.wikipedia.org/wiki/Same_origin_policy
For example in web.xml you'd add something like this:
<context-param>
<param-name>org.apache.myfaces.trinidad.security.FRAME_BUSTING</param-name>
<param-value>differentOrigin</param-value>
</context-param>
The default should be at least differentOrigin, because the default needs to be secure, however differentOrigin is not backwards compatible.
We will not framebust when a portal, portals have a concept of producers and consumers. The main page is the consumer, and the portlets inside that page are the producers. Producer content can only be accessed by trusted consumers.The consumer page can set the context param as needed, but the producers will not do framebusting. In other words, producers will rely on the consumer to address this security issue and, as such, when ExternalContextUtils.isPortlet is true then our producer will behave as if the context parameter is set to 'never'.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (TRINIDAD-2169) add framebusting support to handle
clickjacking attacks
Posted by "Gabrielle Crawford (Updated) (JIRA)" <de...@myfaces.apache.org>.
[ https://issues.apache.org/jira/browse/TRINIDAD-2169?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Gabrielle Crawford updated TRINIDAD-2169:
-----------------------------------------
Status: Open (was: Patch Available)
> add framebusting support to handle clickjacking attacks
> -------------------------------------------------------
>
> Key: TRINIDAD-2169
> URL: https://issues.apache.org/jira/browse/TRINIDAD-2169
> Project: MyFaces Trinidad
> Issue Type: Bug
> Reporter: Gabrielle Crawford
> Attachments: trin2169.patch
>
>
> First you need to understand clickjacking, which is a security issue when using frames (meaning a frame or iframe). Here's some sites that explain it
> http://en.wikipedia.org/wiki/Clickjacking
> http://www.imperva.com/resources/glossary/clickjacking_ui-redressing.html
> http://seclab.stanford.edu/websec/framebusting/framebust.pdf
> With framebusting we would have support so that an app can say whether its pages are allowed to run in a frame. This will be controlled with a new context parameter "org.apache.myfaces.trinidad.security.FRAME_BUSTING". Values are:
> 1. always: always bust frames, meaning don't allow a page to be embedded in frames
> 2. never: never bust frames, meaning always allow a page to be embedded in frames
> 3. differentOrigin: only bust frames if the an ancestor window origin (protocol, host, and port) and the frame origin are different.
> If the ancestor windows and frame have the same origin then allow the content to run in a frame.
> For more infomation on origins see http://en.wikipedia.org/wiki/Same_origin_policy
> For example in web.xml you'd add something like this:
> <context-param>
> <param-name>org.apache.myfaces.trinidad.security.FRAME_BUSTING</param-name>
> <param-value>differentOrigin</param-value>
> </context-param>
> The default should be at least differentOrigin, because the default needs to be secure, however differentOrigin is not backwards compatible.
> We will not framebust when a portal, portals have a concept of producers and consumers. The main page is the consumer, and the portlets inside that page are the producers. Producer content can only be accessed by trusted consumers.The consumer page can set the context param as needed, but the producers will not do framebusting. In other words, producers will rely on the consumer to address this security issue and, as such, when ExternalContextUtils.isPortlet is true then our producer will behave as if the context parameter is set to 'never'.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (TRINIDAD-2169) add framebusting support to
handle clickjacking attacks
Posted by "Gabrielle Crawford (Commented) (JIRA)" <de...@myfaces.apache.org>.
[ https://issues.apache.org/jira/browse/TRINIDAD-2169?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13154793#comment-13154793 ]
Gabrielle Crawford commented on TRINIDAD-2169:
----------------------------------------------
Regarding the implementation we'll run the code.
top.location.href = location.href;
If the setting is 'differentOrigin' we'll walk up the parent window hierarchy to see if any ancestor window is a different origin (see same origin policy for more info). For example let's say you have this window hierarchy
window A in origin A
Window B in origin B
Window C in origin B
First Window B will framebust because it's not in the same origin as its parent Window A. By the time the framebusting code for Window C is run, Window B will be the top level window. Since window B and C have the same origin, window C will not do framebusting.
However there is javascript that can be added to the enclosing page which causes a dialog to pop up and if you hit cancel then you don't navigate, which thwarts our framebusting code that's trying to set top.location.href. Here's an example of the javascript that can be added on the outer page.
<script>
function closeIt()
{
return "Any string value here forces a dialog box to \n" +
"appear before closing the window. \n" +
"If you hit OK then framebusting should proceed. \n" +
"If you hit Cancel then the frame should be blank. \n";
}
window.onbeforeunload = closeIt;
</script>
So in addition to setting top.location.href, we will do the following:
1. Use X-FRAME-OPTIONS (DENY and SAMEORIGIN), an HTTP header. This is not supported on all browsers though. When it is supported (for example IE8 and FF5) the page in the frame won't even load.
2. hide the content by making the body tag display style to none by default, if the framebusting code runs then it will set the body tag display style to block when it's safe to do so. Therefore even if we did try to bust frames but setting "top.location.href" was not successful, the page cannot be interacted with.
> add framebusting support to handle clickjacking attacks
> -------------------------------------------------------
>
> Key: TRINIDAD-2169
> URL: https://issues.apache.org/jira/browse/TRINIDAD-2169
> Project: MyFaces Trinidad
> Issue Type: Bug
> Reporter: Gabrielle Crawford
>
> First you need to understand clickjacking, which is a security issue when using frames (meaning a frame or iframe). Here's some sites that explain it
> http://en.wikipedia.org/wiki/Clickjacking
> http://www.imperva.com/resources/glossary/clickjacking_ui-redressing.html
> http://seclab.stanford.edu/websec/framebusting/framebust.pdf
> With framebusting we would have support so that an app can say whether its pages are allowed to run in a frame. This will be controlled with a new context parameter "org.apache.myfaces.trinidad.security.FRAME_BUSTING". Values are:
> 1. always: always bust frames, meaning don't allow a page to be embedded in frames
> 2. never: never bust frames, meaning always allow a page to be embedded in frames
> 3. differentOrigin: only bust frames if the an ancestor window origin (protocol, host, and port) and the frame origin are different.
> If the ancestor windows and frame have the same origin then allow the content to run in a frame.
> For more infomation on origins see http://en.wikipedia.org/wiki/Same_origin_policy
> For example in web.xml you'd add something like this:
> <context-param>
> <param-name>org.apache.myfaces.trinidad.security.FRAME_BUSTING</param-name>
> <param-value>differentOrigin</param-value>
> </context-param>
> The default should be at least differentOrigin, because the default needs to be secure, however differentOrigin is not backwards compatible.
> We will not framebust when a portal, portals have a concept of producers and consumers. The main page is the consumer, and the portlets inside that page are the producers. Producer content can only be accessed by trusted consumers.The consumer page can set the context param as needed, but the producers will not do framebusting. In other words, producers will rely on the consumer to address this security issue and, as such, when ExternalContextUtils.isPortlet is true then our producer will behave as if the context parameter is set to 'never'.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (TRINIDAD-2169) add framebusting support to handle
clickjacking attacks
Posted by "Gabrielle Crawford (Updated) (JIRA)" <de...@myfaces.apache.org>.
[ https://issues.apache.org/jira/browse/TRINIDAD-2169?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Gabrielle Crawford updated TRINIDAD-2169:
-----------------------------------------
Status: Patch Available (was: Open)
> add framebusting support to handle clickjacking attacks
> -------------------------------------------------------
>
> Key: TRINIDAD-2169
> URL: https://issues.apache.org/jira/browse/TRINIDAD-2169
> Project: MyFaces Trinidad
> Issue Type: Bug
> Reporter: Gabrielle Crawford
> Attachments: trin2169.patch
>
>
> First you need to understand clickjacking, which is a security issue when using frames (meaning a frame or iframe). Here's some sites that explain it
> http://en.wikipedia.org/wiki/Clickjacking
> http://www.imperva.com/resources/glossary/clickjacking_ui-redressing.html
> http://seclab.stanford.edu/websec/framebusting/framebust.pdf
> With framebusting we would have support so that an app can say whether its pages are allowed to run in a frame. This will be controlled with a new context parameter "org.apache.myfaces.trinidad.security.FRAME_BUSTING". Values are:
> 1. always: always bust frames, meaning don't allow a page to be embedded in frames
> 2. never: never bust frames, meaning always allow a page to be embedded in frames
> 3. differentOrigin: only bust frames if the an ancestor window origin (protocol, host, and port) and the frame origin are different.
> If the ancestor windows and frame have the same origin then allow the content to run in a frame.
> For more infomation on origins see http://en.wikipedia.org/wiki/Same_origin_policy
> For example in web.xml you'd add something like this:
> <context-param>
> <param-name>org.apache.myfaces.trinidad.security.FRAME_BUSTING</param-name>
> <param-value>differentOrigin</param-value>
> </context-param>
> The default should be at least differentOrigin, because the default needs to be secure, however differentOrigin is not backwards compatible.
> We will not framebust when a portal, portals have a concept of producers and consumers. The main page is the consumer, and the portlets inside that page are the producers. Producer content can only be accessed by trusted consumers.The consumer page can set the context param as needed, but the producers will not do framebusting. In other words, producers will rely on the consumer to address this security issue and, as such, when ExternalContextUtils.isPortlet is true then our producer will behave as if the context parameter is set to 'never'.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (TRINIDAD-2169) add framebusting support to handle
clickjacking attacks
Posted by "Gabrielle Crawford (Updated) (JIRA)" <de...@myfaces.apache.org>.
[ https://issues.apache.org/jira/browse/TRINIDAD-2169?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Gabrielle Crawford updated TRINIDAD-2169:
-----------------------------------------
Status: Patch Available (was: Open)
> add framebusting support to handle clickjacking attacks
> -------------------------------------------------------
>
> Key: TRINIDAD-2169
> URL: https://issues.apache.org/jira/browse/TRINIDAD-2169
> Project: MyFaces Trinidad
> Issue Type: Bug
> Reporter: Gabrielle Crawford
>
> First you need to understand clickjacking, which is a security issue when using frames (meaning a frame or iframe). Here's some sites that explain it
> http://en.wikipedia.org/wiki/Clickjacking
> http://www.imperva.com/resources/glossary/clickjacking_ui-redressing.html
> http://seclab.stanford.edu/websec/framebusting/framebust.pdf
> With framebusting we would have support so that an app can say whether its pages are allowed to run in a frame. This will be controlled with a new context parameter "org.apache.myfaces.trinidad.security.FRAME_BUSTING". Values are:
> 1. always: always bust frames, meaning don't allow a page to be embedded in frames
> 2. never: never bust frames, meaning always allow a page to be embedded in frames
> 3. differentOrigin: only bust frames if the an ancestor window origin (protocol, host, and port) and the frame origin are different.
> If the ancestor windows and frame have the same origin then allow the content to run in a frame.
> For more infomation on origins see http://en.wikipedia.org/wiki/Same_origin_policy
> For example in web.xml you'd add something like this:
> <context-param>
> <param-name>org.apache.myfaces.trinidad.security.FRAME_BUSTING</param-name>
> <param-value>differentOrigin</param-value>
> </context-param>
> The default should be at least differentOrigin, because the default needs to be secure, however differentOrigin is not backwards compatible.
> We will not framebust when a portal, portals have a concept of producers and consumers. The main page is the consumer, and the portlets inside that page are the producers. Producer content can only be accessed by trusted consumers.The consumer page can set the context param as needed, but the producers will not do framebusting. In other words, producers will rely on the consumer to address this security issue and, as such, when ExternalContextUtils.isPortlet is true then our producer will behave as if the context parameter is set to 'never'.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira