Missing X-Frame-Options Header In Dsound

Components

Dsound.audio is vulnerable to Clickjacking. Clickjacking is a technique of fooling a web user by creating a special webpage. In that webpage attacker can make user to do a special task and then attacker may get victim's confidential data or attacker can make victim to do upvotes or follow to particular user.

Proposal

Dsound.audio should add X-Frame-Options. X-Frame-Options (XFO) header takes one of three values: DENY, SAMEORIGIN, or ALLOW-FROM. DENY option to display of the page within a frame. SAMEORIGIN allows the page to be framed but only by pages with the same origin. The ALLOW-FROM value is used to together with a specific domain.

Examples

Before implementing X-frame-option.

After implementing X-frame-option.

Poof-Of-Concept

<iframe src="https://dsound.audio/#!/feed" height="500px" width="500px">
  <p>Your browser does not support iframes.</p>
</iframe>

Benefits

After implementing this, Dsound.audio will not open in iframe tag. That means it will be safe from clickjacking bug as well as from attacker too.

---

Posted on Utopian.io - Rewarding Open Source Contributors

---