From gphemsley@gmail.com Mon Nov 5 10:02:20 2012 Return-Path: X-Original-To: websec@ietfa.amsl.com Delivered-To: websec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2EB9521F8428 for ; Mon, 5 Nov 2012 10:02:20 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.598 X-Spam-Level: X-Spam-Status: No, score=-3.598 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id M2C57ets2Jz5 for ; Mon, 5 Nov 2012 10:02:19 -0800 (PST) Received: from mail-wg0-f44.google.com (mail-wg0-f44.google.com [74.125.82.44]) by ietfa.amsl.com (Postfix) with ESMTP id A627521F84D5 for ; Mon, 5 Nov 2012 09:59:56 -0800 (PST) Received: by mail-wg0-f44.google.com with SMTP id dr13so2917956wgb.13 for ; Mon, 05 Nov 2012 09:59:55 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :content-type; bh=BY3guUgiZwn3NgFHOBVWRwLvi3Pst5ym6qH7sg6kRhk=; b=sR+/m3h8qLGCRQJY6eJnDqGCodSFzzUR0yB3CvkikIk2GxOxTFlFNwytfs4ibgELBu 4HXYFXzvFEsYFSXJCsa9Lrn4FuvQ8zM1GmL4x38LeXqsmcnpUEPS6vc0tesuFI61XeEs EJPTMsVSD6py4Djz0quO7u3Og1W+eiRgFFebZJQSczJWuKZtUFw2FFUwgXp5VXDDgcex 0VDo7Ay01/RKzvDQ92nWhaD8hjl69buS3/pRTlqHX1C+WWbg9bVdoz3uNvHtu0DytLGw UJnV08u2fIjaRimchTmsv/tItVcWDnTyIF7bnfHepkLufGWjjEieBhQuGcHKPKvMc0uv BTtA== Received: by 10.216.226.216 with SMTP id b66mr3711951weq.155.1352138395487; Mon, 05 Nov 2012 09:59:55 -0800 (PST) MIME-Version: 1.0 Received: by 10.227.173.206 with HTTP; Mon, 5 Nov 2012 09:59:35 -0800 (PST) In-Reply-To: References: From: "Gordon P. Hemsley" Date: Mon, 5 Nov 2012 12:59:35 -0500 Message-ID: To: IETF websec Content-Type: multipart/alternative; boundary=00504502dc2bc010a004cdc340ce Subject: [websec] [mimesniff] Review requested on MIME Sniffing Standard X-BeenThere: websec@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Web Application Security Minus Authentication and Transport List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Nov 2012 18:02:20 -0000 --00504502dc2bc010a004cdc340ce Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Originally sent to the WHATWG list. ---------- Forwarded message ---------- From: Gordon P. Hemsley Date: Mon, Nov 5, 2012 at 10:28 AM Subject: [mimesniff] Review requested on MIME Sniffing Standard To: whatwg List Hey all, As you might have heard, I have taken over editorship of the MIME Sniffing Standard from Adam Barth. As a first step in my editorship, I have taken the opportunity to rewrite the document in a more procedural and modular way (IMO). The content and meaning itself is not supposed to have changed, and I need your help to verify that that is the case: http://mimesniff.spec.whatwg.org/ In addition, this now means that I am open to hearing your suggestions about how to improve the document beyond its current (i.e. former) semantics. You can file bugs here: https://www.w3.org/Bugs/Public/enter_bug.cgi?product=3DWHATWG&component=3DM= IME As this document was originally an IETF document, there are also old issues here: http://trac.tools.ietf.org/wg/websec/trac/query?component=3Dmime-sniff It's not clear to me which of those remain outstanding on the current version of the document, and it would be helpful to me if individuals with a vested interest in them could migrate them to Bugzilla (with updated descriptions that reflect the current state of the document). This will ensure that I address them in a timely manner. Also, it would be helpful if you could mark them as blocking the general bug here: https://www.w3.org/Bugs/Public/show_bug.cgi?id=3D19746 And if you want to follow the commits as they happen, you can follow @mimesniff on Twitter: https://twitter.com/mimesniff Thanks! Gordon --=20 Gordon P. Hemsley me@gphemsley.org http://gphemsley.org/ =E2=80=A2 http://gphemsley.org/blog/ --=20 Gordon P. Hemsley me@gphemsley.org http://gphemsley.org/ =E2=80=A2 http://gphemsley.org/blog/ --00504502dc2bc010a004cdc340ce Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Originally sent to the WHATWG list.

-----= ----- Forwarded message ----------
From: G= ordon P. Hemsley <gphemsley@gmail.com>
Date: Mon, Nov 5, 2012 at 10:28 AM
Subject: [mimesniff] Review requested= on MIME Sniffing Standard
To: whatwg List <whatwg@whatwg.org>


Hey all,

As you mig= ht have heard, I have taken over editorship of the MIME Sniffing Standard f= rom Adam Barth.

As a first step in my editorship, I have taken the opportunity to rewri= te the document in a more procedural and modular way (IMO). The content and= meaning itself is not supposed to have changed, and I need your help to ve= rify that that is the case:

http://= mimesniff.spec.whatwg.org/

In addition, this now means that I am= open to hearing your suggestions about how to improve the document beyond = its current (i.e. former) semantics.

You can file bugs here:

ht= tps://www.w3.org/Bugs/Public/enter_bug.cgi?product=3DWHATWG&component= =3DMIME

As this document was originally an IETF document, there are also old is= sues here:

http://trac.tools.ietf.org/wg/websec/trac/que= ry?component=3Dmime-sniff

It's not clear to me which of thos= e remain outstanding on the current version of the document, and it would b= e helpful to me if individuals with a vested interest in them could migrate= them to Bugzilla (with updated descriptions that reflect the current state= of the document). This will ensure that I address them in a timely manner.=

Also, it would be helpful if you could mark them as blocking the genera= l bug here:

https://www.w3.org/Bugs/Public/show_bug.cgi?id= =3D19746

And if you want to follow the commits as they happen, you can follow @mimes= niff on Twitter:

https://twitter.com/mimesniff

Thanks!

Gordon

--
Gordon P. Hemsley
me@gphemsley.org
http://gphemsley.org/ =E2=80=A2 http://gphemsley.org/blog/



--
Gordon P. Hemsley
<= a href=3D"mailto:me@gphemsley.org" target=3D"_blank">me@gphemsley.orghttp://gphemsley.org/= =E2=80=A2 htt= p://gphemsley.org/blog/
--00504502dc2bc010a004cdc340ce-- From Jeff.Hodges@KingsMountain.com Mon Nov 5 11:30:02 2012 Return-Path: X-Original-To: websec@ietfa.amsl.com Delivered-To: websec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 0699D21F87CE for ; Mon, 5 Nov 2012 11:30:02 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.432 X-Spam-Level: X-Spam-Status: No, score=-102.432 tagged_above=-999 required=5 tests=[AWL=0.167, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id IgmjOQNBbM6e for ; Mon, 5 Nov 2012 11:30:01 -0800 (PST) Received: from oproxy11-pub.bluehost.com (oproxy11-pub.bluehost.com [173.254.64.10]) by ietfa.amsl.com (Postfix) with SMTP id 81C9821F8695 for ; Mon, 5 Nov 2012 11:30:00 -0800 (PST) Received: (qmail 16404 invoked by uid 0); 5 Nov 2012 19:29:19 -0000 Received: from unknown (HELO box514.bluehost.com) (74.220.219.114) by oproxy11.bluehost.com with SMTP; 5 Nov 2012 19:29:19 -0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=kingsmountain.com; s=default; h=Content-Transfer-Encoding:Content-Type:Subject:To:MIME-Version:From:Date:Message-ID; bh=AgGtjL+JdpWwVMB44PGsfOh8/QE6bU+7wcK7z9Q7AEk=; b=OTqITDxcQMNI+SpbD+yzTbEhcaeqEwxZVZwBnvjBXfNUMQAb7wTyBmf5YQToj8OrBEf4uBtYPimGx+yLK9NiXRXh/pRC9iSmbC5glChKAK4AHRO6WXxR4dUxiKMbqkVH; Received: from [130.129.80.110] (port=39683) by box514.bluehost.com with esmtpsa (TLSv1:CAMELLIA256-SHA:256) (Exim 4.76) (envelope-from ) id 1TVSMJ-0005Or-EM for websec@ietf.org; Mon, 05 Nov 2012 12:29:19 -0700 Message-ID: <5098138E.1010001@KingsMountain.com> Date: Mon, 05 Nov 2012 11:29:18 -0800 From: =JeffH User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:16.0) Gecko/20121011 Thunderbird/16.0.1 MIME-Version: 1.0 To: IETF WebSec WG Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Identified-User: {11025:box514.bluehost.com:kingsmou:kingsmountain.com} {sentby:smtp auth 130.129.80.110 authed with jeff.hodges+kingsmountain.com} Subject: Re: [websec] Preliminary agenda uploaded X-BeenThere: websec@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Web Application Security Minus Authentication and Transport List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Nov 2012 19:30:02 -0000 HI, > We've uploaded the preliminary agenda for the Atlanta meeting. > > http://www.ietf.org/proceedings/85/agenda/agenda-85-websec > > IETF-85 WebSec > Thursday, November 8, 17:30-18:30 > ---------------------------------- > 1. Note Well, Agenda, Note Takers, Blue sheets (5 min) > 2. Document Status (5 min) > 3. Pinning (20 min) > http://tools.ietf.org/html/draft-ietf-websec-key-pinning-03 > 4. Future of Frame-Options (10 min) > http://tools.ietf.org/html/draft-gondrom-frame-options-02 > 5. Security Framework (15 min) - Jeff Hodges > http://tools.ietf.org/html/draft-hodges-websec-framework-reqs-02 > 6. Open Mike (5 min) I suggest a modest rearrangement of the agenda since my item, security framework, is mostly consciousness-raising and likely to be short, and perhaps less than 10min. I'm not sure of the order between pinning and frame-options, both will likely have some non-trivial discussion. so one shot at yet another agenda update is... Thursday, November 8, 17:30-18:30 ---------------------------------- 1. Note Well, Agenda, Note Takers, Blue sheets (5 min) 2. Document Status (5 min) 3. Security Framework (10 min) - Jeff Hodges http://tools.ietf.org/html/draft-hodges-websec-framework-reqs-02 4. Pinning (20 min) http://tools.ietf.org/html/draft-ietf-websec-key-pinning-03 5. Future of Frame-Options (15 min) http://tools.ietf.org/html/draft-gondrom-frame-options-02 6. Open Mike (5 min) HTH, =JeffH From alexey.melnikov@isode.com Tue Nov 6 08:08:51 2012 Return-Path: X-Original-To: websec@ietfa.amsl.com Delivered-To: websec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 212E321F89A0 for ; Tue, 6 Nov 2012 08:08:51 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.103 X-Spam-Level: X-Spam-Status: No, score=-102.103 tagged_above=-999 required=5 tests=[AWL=-0.496, BAYES_00=-2.599, DATE_IN_PAST_12_24=0.992, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AsMObVYe8yKX for ; Tue, 6 Nov 2012 08:08:50 -0800 (PST) Received: from waldorf.isode.com (cl-125.lon-03.gb.sixxs.net [IPv6:2a00:14f0:e000:7c::2]) by ietfa.amsl.com (Postfix) with ESMTP id 6E06821F893C for ; Tue, 6 Nov 2012 08:08:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; t=1352218128; d=isode.com; s=selector; i=@isode.com; bh=iZn+mh1vI35DbwBdzA9IYdJERytKP3OEOwX5ICVX6Sg=; h=From:Sender:Reply-To:Subject:Date:Message-ID:To:Cc:MIME-Version: In-Reply-To:References:Content-Type:Content-Transfer-Encoding: Content-ID:Content-Description; b=lgN5RF2bAS4hVlmlIqj1l/S2aPh1iBNtD4AANtuN24wR+0Gq4aFLjRYT2g3ea5n68P+XiX 6GwByQQAJPFcrjCm28Iq0VAN94TzlzWaNHWUS6JK1PGf5XlGKH/HmL0TCZvMo60IdC3mmD Unlp5F9f33la2w9Z0CAlhXnQb8xLb1Q=; Received: from [130.129.18.182] (dhcp-12b6.meeting.ietf.org [130.129.18.182]) by waldorf.isode.com (submission channel) via TCP with ESMTPA id ; Tue, 6 Nov 2012 16:08:48 +0000 Message-ID: <50984991.6000601@isode.com> Date: Mon, 05 Nov 2012 23:19:45 +0000 From: Alexey Melnikov User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:13.0) Gecko/20120614 Thunderbird/13.0.1 To: IETF WebSec WG References: <124AE7B2-5EB7-42E6-A4CA-F89B2AEF43F8@checkpoint.com> In-Reply-To: <124AE7B2-5EB7-42E6-A4CA-F89B2AEF43F8@checkpoint.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [websec] WGLC for X-Frame-Options X-BeenThere: websec@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Web Application Security Minus Authentication and Transport List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Nov 2012 16:08:51 -0000 Here is my review (with my co-chair hat off): [RFC3986] should be a Normative reference (as it is required to parse/generate a valid X-Frame-Options header field). [RFC6454] is normative, because there is a SHOULD requirement to use it. In Section 2.1: The ALLOW-FROM URI MUST be valid. I don't know what this mean exactly. Can you elaborate? 2.2. Backus-Naur Form (BNF) The RFC 822 [RFC0822] EBNF of the X-Frame-Options header is: Which makes [RFC0822] Normative. X-Frame-Options = "Frame-Options" ":" "DENY"/ "SAMEORIGIN" / ("ALLOW-FROM" ":" URI) With URI as defined in [RFC3986] [TBD] Or should we use the ABNF (RFC 2234) alternatively to EBNF or in addition? Yes, you should use RFC 5234. This probably means inserting "[WSP]" in various places, but I think that would be much better. 2.3.2. Browser Behaviour and Processing To allow secure implementations, browsers MUST behave in a consistent and reliable way. This is self evident, IMHO, and I don't think it adds much value. How exactly violation or conformance to this MUST be verified? I suggest deleting the sentence. 2.4.1. Example scenario for the ALLOW-FROM parameter 1. Inner IFRAME suggests via a querystring parameter what site it wants to be hosted by. This can obviously be specified by an attacker, but that's OK. I blame lack of sleep, but can you explain this to me in more details? 5. Security Considerations The introduction of the http header X-FRAME-OPTIONS does improve the protection against Clickjacking, however it is not self-sufficient on its own but MUST be used in conjunction with other security measures like secure coding and Content Security Policy (CSP) CSP needs an Informative reference. From julian.reschke@gmx.de Tue Nov 6 08:26:10 2012 Return-Path: X-Original-To: websec@ietfa.amsl.com Delivered-To: websec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E711321F8A0F for ; Tue, 6 Nov 2012 08:26:10 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -106.599 X-Spam-Level: X-Spam-Status: No, score=-106.599 tagged_above=-999 required=5 tests=[AWL=-4.000, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2kf6FubZaQxK for ; Tue, 6 Nov 2012 08:26:10 -0800 (PST) Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.23]) by ietfa.amsl.com (Postfix) with SMTP id 066BF21F8A12 for ; Tue, 6 Nov 2012 08:26:09 -0800 (PST) Received: (qmail invoked by alias); 06 Nov 2012 16:26:08 -0000 Received: from mail.greenbytes.de (EHLO [192.168.1.140]) [217.91.35.233] by mail.gmx.net (mp069) with SMTP; 06 Nov 2012 17:26:08 +0100 X-Authenticated: #1915285 X-Provags-ID: V01U2FsdGVkX1+psz9bf8Cpiz4SNoPEWKimE6ZaTCjmtU4qY5Y/l6 pk8RlNge1AmF+3 Message-ID: <50993A1E.1010205@gmx.de> Date: Tue, 06 Nov 2012 17:26:06 +0100 From: Julian Reschke User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20121026 Thunderbird/16.0.2 MIME-Version: 1.0 To: Alexey Melnikov References: <124AE7B2-5EB7-42E6-A4CA-F89B2AEF43F8@checkpoint.com> <50984991.6000601@isode.com> In-Reply-To: <50984991.6000601@isode.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Y-GMX-Trusted: 0 Cc: IETF WebSec WG Subject: Re: [websec] WGLC for X-Frame-Options X-BeenThere: websec@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Web Application Security Minus Authentication and Transport List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Nov 2012 16:26:11 -0000 On 2012-11-06 00:19, Alexey Melnikov wrote: > Here is my review (with my co-chair hat off): > > [RFC3986] should be a Normative reference (as it is required to > parse/generate > a valid X-Frame-Options header field). > > [RFC6454] is normative, because there is a SHOULD requirement to use it. > > In Section 2.1: > > The ALLOW-FROM URI MUST be valid. > > I don't know what this mean exactly. Can you elaborate? > > 2.2. Backus-Naur Form (BNF) > > The RFC 822 [RFC0822] EBNF of the X-Frame-Options header is: > > Which makes [RFC0822] Normative. > > X-Frame-Options = "Frame-Options" ":" "DENY"/ "SAMEORIGIN" / > ("ALLOW-FROM" ":" URI) > > With URI as defined in [RFC3986] > [TBD] Or should we use the ABNF (RFC 2234) alternatively to EBNF or > in addition? > > Yes, you should use RFC 5234. This probably means inserting "[WSP]" in > various > places, but I think that would be much better. > ... Almost. You should reference HTTPbis Part 1, and, in particular, *only* define the ABNF for the field value. Best regards, Julian From julian.reschke@gmx.de Tue Nov 6 09:25:50 2012 Return-Path: X-Original-To: websec@ietfa.amsl.com Delivered-To: websec@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 77FA521F8A60 for ; Tue, 6 Nov 2012 09:25:50 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -105.599 X-Spam-Level: X-Spam-Status: No, score=-105.599 tagged_above=-999 required=5 tests=[AWL=-3.000, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id qou+WGQvY1WE for ; Tue, 6 Nov 2012 09:25:49 -0800 (PST) Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.22]) by ietfa.amsl.com (Postfix) with SMTP id BCD7721F8A49 for ; Tue, 6 Nov 2012 09:25:47 -0800 (PST) Received: (qmail invoked by alias); 06 Nov 2012 17:25:46 -0000 Received: from mail.greenbytes.de (EHLO [192.168.1.140]) [217.91.35.233] by mail.gmx.net (mp040) with SMTP; 06 Nov 2012 18:25:46 +0100 X-Authenticated: #1915285 X-Provags-ID: V01U2FsdGVkX18JOXI1QToJafd2c7L+TVDwrYpZMl+fAbXO3J0McF fCcAeGCBV3eRgr Message-ID: <50994817.1030503@gmx.de> Date: Tue, 06 Nov 2012 18:25:43 +0100 From: Julian Reschke User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20121026 Thunderbird/16.0.2 MIME-Version: 1.0 To: Yoav Nir References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Y-GMX-Trusted: 0 Cc: IETF WebSec WG Subject: [websec] WGLC feedback for X-Frame-Options X-BeenThere: websec@ietf.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Web Application Security Minus Authentication and Transport List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Nov 2012 17:25:50 -0000 Hi there, here's my feedback from the HTTP/editorial point of view: > Abstract > > To improve the protection of web applications against Clickjacking > this standard defines an http response header that declares a policy s/standard/specification/ s/http response header/HTTP response header field/ > communicated from a host to the client browser on whether the browser > must not display the transmitted content in frames of other web > pages. This drafts serves to document the existing use and drafts? > In 2009 and 2010 many browser vendors ([Microsoft-X-Frame-Options], > [CLICK-DEFENSE-BLOG], [Mozilla-X-Frame-Options]) introduced the use > of a non-standard http header RFC 2616 [RFC2616] "X-Frame-Options" to s/http header RFC 2616 [RFC2616]/HTTP [RFC2616] header field/ > protect against Clickjacking [Clickjacking]. This draft is to > document the current use of X-Frame-Options header and shall in the > future be replaced by the Frame-Options [FRAME-OPTIONS] standard. What's supposed to be replaced is the header field, not the spec, right? > 2. X-Frame-Options Header > > > The X-Frame-Options HTTP response header indicates a policy whether a s/header/header field/ throughout. > browser MUST NOT allow to render a page in a or