Quantcast
Channel: Claims based access platform (CBA), code-named Geneva forum
Viewing all articles
Browse latest Browse all 2535

Active Directory Federated Services - X-Frame-Options DENY

$
0
0

Redirecting question here fromas suggested

We have a family of products that do intranet single sign on using ADFS.

We recently setup an AD FS 3 to verify compatibility. All protocols and token formats work without a problem but we have a huge problem.

Our web applications dependent heavily on iframes. But AD FS 3 suddenly is adding the following header to its response

X-Frame-Options

DENY

Currently IE11 is working but Chrome and Firefox are not. 

AD FS provides no option to enable this header or not. I even checked into the code and see that there is not condition that can drive this. The following is from Microsoft.IdentityServer.Web.UI.PageBase

		protected void Render()
		{
			string text = this.PageTemplate;
			if (!this.AllowIFrame)
			{
				this.HttpListenerContext.Response.AddHeader("x-frame-options", "DENY");
			}
			this.HttpListenerContext.Response.Headers.Add(HttpResponseHeader.CacheControl, "no-cache");
			this.HttpListenerContext.Response.Headers.Add(HttpResponseHeader.CacheControl, "no-store");
			this.HttpListenerContext.Response.Headers.Add(HttpResponseHeader.Pragma, "no-cache");
			this.HttpListenerContext.Response.Headers.Add(HttpResponseHeader.Expires, "-1");
			text = this.ApplyTheme(text);
			text = this.RenderPageSpecifics(text);
			HttpContextUtility.WriteStringResponse(this.HttpListenerContext.Response, text);
		}
 

I understand the security reasons behind this choice and I also understand the potential vulnerabilities using iframes.

But iframes with all their potential problems are a legacy solution and are still present in many applications. This hard coded choice practically excludes these applications from upgrading integration with AD FS 3. This is even more weird, since IE is the one that doesn't respect the header and doesn't block the frame as Chrome and Firefox do.

I already seen this related thread

Please advice on this matter.


Viewing all articles
Browse latest Browse all 2535

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>