I&#39;m implementing a &quot;pass-through&quot; for `X-Frame-Options` to let a partner site wrap my employer&#39;s site in an iframe, as per this article: http://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx

(splitting up URLS to post)

In a nutshell, our partner&#39;s page has an iframe with an URL against our domain.
For any page in our domain, they&#39;ll add a special url argument like `&amp;@mykey=topleveldomain.com`, telling us what the page&#39;s top level domain is.

Our filters pick up the partner TLD, if provided, from the URL, and validate it against a whitelist.  If it&#39;s on the list, we ship the `X-Frame-Options` header with value `ALLOW-FROM topleveldomain.com` (and add a cookie for future clicks).  If it&#39;s not on our whitelist, we ship `SAMEORIGIN` or `DENY`.

The problem is it looks like sending `ALLOW-FROM domain` results in a no-op overall for the latest Firefox and Google Chrome.  IE8, at least, seems to be correctly implementing `ALLOW-FROM`.

Check out this page:  http://www.enhanceie.com/test/clickjack.  Right after the 5th (of 5) boxes that &quot;should be showing content&quot;, is a box that should NOT be showing content, but which is.  In this case, the page in the iframe is sending `X-Frame-Options: ALLOW-FROM http://www.debugtheweb.com`, a decidedly different TLD than `http://www.enhanceie.com`.  Yet, the frame still displays content.

Any insight as to whether `X-Frame-Options` is truly implemented with `ALLOW-FROM` across relevant (desktop) browsers?  Perhaps the syntax has changed?

Some links of interest: 

* Draft rfc on x-frame-options: https://datatracker.ietf.org/doc/html/draft-gondrom-frame-options-01
* developer.mozilla article discussing the header as a 2-option header (sameorigin or deny).  https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options
* msdn blog that initiated the whole thing: http://blogs.msdn.com/b/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx
* msdn blog that talks about 3 values: adding allow-from origin http://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx

All Clickjacking Solutions on Gang of Coders

Total of 1 Clickjacking Solutions

X-Frame-Options: ALLOW-FROM in firefox and chrome