Standard 6 - Frame Busting

[Nat Sakimura]

We mention Frame Busting. We probably should call out X-Frame Header as well.

[Michael Jones]

Nat to propose concrete text

[Nat Sakimura]

In section 6 of the Standard, the last para states:

Clients SHOULD employ frame busting and other techniques to prevent End-Users from being logged in by third party sites without their knowledge.

It should be changed to

Clients SHOULD employ frame busting and other techniques to prevent End-Users from being logged in by third party sites without their knowledge through such attacks as clickjacking. Refer to 4.4.1.9 of RFC6819 for more details.

[Nat Sakimura]

Added the proposed text.

[Michael Jones]

Fixed #874 - Said more about frame busting

→ <<cset 926cea48d5ba>>