   [web] How to keep your site from getting 'framed'?
  I assume this is an easily solved problem or the web would be in chaos.My website www.roblox.com is being displayed in a full-window frame at http://www.places.tk.* How can I prevent this?* What is their motivation for framing my site? Can they use &#106avascript to keylog people and steal their accounts?Thanks!   
Quote:Original post by Telamon* How can I prevent this?You can detect it with &#106avascript and then break out. However, I would recommend against it. Many useful sites do the same thing for valid reasons, Like Google Cache and Image search, Stumbleupon, etcetera.Quote:* What is their motivation for framing my site?Ask them: http://whois.domaintools.com/places.tk.Quote:Can they use &#106avascript to keylog people and steal their accounts?No, unless your website is vulnerable from XSS (Cross-Site Scripting) attacks. But if you are vulnerable to XSS then you have bigger problems then just a framer on another domain.;  http://en.wikipedia.org/wiki/Framekiller   ;  So what would stop these people from floating an iframe above our login panel and stealing passwords?Are you guys telling me that there is no solution for this problem?If so, why isn't Wells Fargo and Bank of America being framed from Turkey and people having their accounts emptied?   ;Quote:Original post by TelamonMy website www.roblox.com is being displayed in a full-window frame at http://www.places.tk.Man, that really sucks. Have you contacted the host? There's two email addresses you can use in the page Sander referred to.There's at least two hacks I can think of that can be used as a temporary solution. They're not full proof by any means, but perhaps it'll buy you some time.Like suggested, you can use a little &#106avascript to detect whether your page is part of a frame set. If the parent window (http://www.places.tk) has frames, redirect it to your own URL:if (parent.frames.length > 0)  parent.location = "http://www.roblox.com";Of course this isn't going to work if the client has disabled &#106avascript.<br><br><br>The second thing you could consider is to check for the HTTP referrer URL. If your page is part of a frame set, the referrer should contain the "places.tk" domain name. It depends &#111;n the server side scripting language you use, but in PHP:<br><br><pre>if(stristr($_SERVER["HTTP_REFERER"], "places.tk") !== FALSE)<br>  &#112;arent.location = "http://www.roblox.com";</pre><br>Again it's not perfect as they can spoof or remove the referrer. But if they're not too smart, it'll take them a little while to figure out.<br><br>Good luck.   ;Quote:Original post by TelamonSo what would stop these people from floating an iframe above our login panel and stealing passwords?Are you guys telling me that there is no solution for this problem?If so, why isn't Wells Fargo and Bank of America being framed from Turkey and people having their accounts emptied?Because they don't have access to them - see what Sander said about XSS. Also see "Same origin policy".   ;  I'd say they wanted an easy way to get to their showcase, judging from the source. Harmless.   ;  Just break out of frames. Regardless of whether your site is XSSable, they can still, as you said, iFrame the login or phish/spoof the user. At the moment they aren't, but that doesn't mean they won't.   ;  I think &#106avascript may be your only option<script>if (window!=top){top.location.href=location.href;}</script>