Let&#39;s say you don&#39;t want other sites to &quot;frame&quot; your site in an `&lt;iframe&gt;`:

    &lt;iframe src=&quot;http://example.org&quot;&gt;&lt;/iframe&gt;

So you insert anti-framing, frame busting JavaScript into all your pages:

    /* break us out of any containing iframes */
    if (top != self) { top.location.replace(self.location.href); }

Excellent! Now you &quot;bust&quot; or break out of any containing iframe automatically. Except for one small problem.

As it turns out, **your frame-busting code can be busted**, [as shown here](http://coderrr.wordpress.com/2009/02/13/preventing-frame-busting-and-click-jacking-ui-redressing/):

    &lt;script type=&quot;text/javascript&quot;&gt;
        var prevent_bust = 0  
        window.onbeforeunload = function() { prevent_bust++ }  
        setInterval(function() {  
          if (prevent_bust &gt; 0) {  
            prevent_bust -= 2  
            window.top.location = &#39;http://example.org/page-which-responds-with-204&#39;  
          }  
        }, 1)  
    &lt;/script&gt;

This code does the following:

- increments a counter every time the browser attempts to navigate away from the current page, via the `window.onbeforeunload` event handler
- sets up a timer that fires every millisecond via `setInterval()`, and if it sees the counter incremented, changes the current location to a server of the attacker&#39;s control
- that server serves up a page with HTTP status code **204**, which does not cause the browser to navigate anywhere

My question is -- and this is more of a JavaScript puzzle than an actual *problem* -- how can you defeat the frame-busting buster? 

I had a few thoughts, but nothing worked in my testing:

- attempting to clear the `onbeforeunload` event via `onbeforeunload = null` had no effect
- adding an `alert()` stopped the process let the user know it was happening, but did not interfere with the code in any way; clicking OK lets the busting continue as normal
- I can&#39;t think of any way to clear the `setInterval()` timer

I&#39;m not much of a JavaScript programmer, so here&#39;s my challenge to you: **hey buster, can you bust the frame-busting buster?**

All Framebusting Solutions on Gang of Coders

Total of 1 Framebusting Solutions

Frame Buster Buster ... buster code needed