Brian Tully 056151cc70 Add anti-ClickJack XFS hardening for old browsers ... A Cross-Frame Scripting (XFS) vulnerability can allow an attacker to load the vulnerable application inside an HTML iframe tag on a malicious page. An attacker could use XFS to devise a Clickjacking attack to conduct phishing, frame sniffing, social engineering or Cross-Site Request Forgery attacks. Although many pages within Horizon leverage the X-Frame-Options header with the recommended SAMEORIGIN policy, some (still popular) older browsers don’t support this setting. Namely, browsers older than IE 8 and Firefox 3.6.9 don’t recognize the header and are thus vulnerable to an attack known as ClickJacking unless an additional mitigating control is present. To support legacy browsers, a suggested best practice is to add a frame breaking script to the base/global template file. Reference: http://tinyurl.com/anticlickjack Change-Id: Ibd7acd0d7b4c4d58afcd59f025735bfc9e4c2957 Closes-Bug: 1461154		2015-07-02 12:57:35 -04:00
..
__init__.py	Context selection for project and region	2014-09-02 09:38:27 -06:00
context_selection.py	Add anti-ClickJack XFS hardening for old browsers	2015-07-02 12:57:35 -04:00