0

I've been searching for awhile and tried several anti frame buster codes and none of them truly work. So my question is, can I have PHP or JavaScript scan all the urls and see if it's a redirect and take the redirect url and use it instead of the original url? I'm using an API and I'm iframing links it gives me and the urls keep redirecting my users to their website instead of keeping their stuff in my frame.

1

1 Answer 1

3

If a site doesn't want to be framed, you can't make it (unless you turn off javascript in the browser).

It's the site's prerogative to determine whether it busts out of a frame, refuses to show it's content if framed or allows it.

There are methods to try to combat frame busting which turns into some sort of war of techniques, but a site can simply render its content invisible if it chooses. If a site doesn't want to be used framed, it can prevent it. It is their content after all. They should have the right to decide how it is or isn't displayed.

In modern browsers as of 2018, the X-FRAME-OPTIONS header appears to be the most reliable way to prevent framing. This article Clickjacking Defense Sheet provides a discussion of various other methods for legacy browsers. Legacy browsers (I'm mostly talking about IE) have some weaknesses that allow an attacker to defeat certain frame busting techniques.

9
  • Do you know if there is any way to display another sites content without taking the user away? As far as I know this is the only solution to what I'm trying to do.
    – Stephen
    Aug 3, 2012 at 15:58
  • Nothing I know of in a pure browser-based app.
    – jfriend00
    Aug 3, 2012 at 16:09
  • I don't know of any other options besides only using static screen shots or finding example sites that don't mind being framed. As I said, if a site doesn't want to be framed, you can't make it. If the framed sites would cooperate with you, they could allow the framing when the top window is your domain.
    – jfriend00
    Aug 3, 2012 at 16:24
  • Yeah, that's what I figured. The only thing is, most of the sites I'm framing the redirect that you get sent to doesn't have any frame busting on it. If I could just sniff the url with JavaScript or PHP and print out the src url it would work, do you know if this is doable?
    – Stephen
    Aug 3, 2012 at 16:35
  • You deleted your comment that contains a link to the actual site you're asking about so I can't examine it any more. If there exists a non-frame-busting URL for these sites, then you would just have to manually record what those URLs are and use them in your site/frame. If you meant something else by your last comment, then I don't understand.
    – jfriend00
    Aug 3, 2012 at 16:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.