Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

It's worth pointing out that you can replace the functionality of the X-Frame-Options header with Content-Security-Policy using the frame-ancestors directive if you want to: https://scotthelme.co.uk/csp-cheat-sheet/#frame-ancestors

A world with opt-in to unsafe behaviour would be great, but a long way off I fear. Thanks for mentioning the header check service!



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: