Frames Yes! Frames No!
Application Security Testing: An Integral Part of DevOps
Frames, frames, frames. You either love them or hate them. Either way, you have to deal with them. Maybe you won't write them to your pages, but others do.
One of the most popular formats of Web page design is that two-column, seamless-frame look. I have a tutorial on it here. Although I'm not a fan of frames myself, I do like this look when done correctly. You get a nice row of buttons down the left-hand side that controls what comes up in the right hand frame. It's a good look as long as the author only puts pages built for the format into that larger frame. But that doesn't always happen.
Often authors want to never allow people to leave their site, so they "lock" in the user by making it so that all pages open in that right hand frame window unless the user makes a point of leaving the frame system altogether. You can imagine what that does to the look of some pages. They get scrunched into a smaller space than what they were built for and just look terrible.
Here I'm going to give you the code for disallowing your pages to appear in frame windows and disallowing your pages to appear without being set into a frame window.
Here's what's Happening
- This is a conditional statement (note the "if") that checks for a frame format.
- The line parent.frames.length!=0 checks to see if there are frames.
- parent is the top level window, the one you're looking at.
- frames denotes that frames are involved.
- length is a count of the number of frames.
- Moving along, top.location sets up a hypertext link to refill the top location, the browser screen you're looking at.
Yes Frames!So you've got a page that you want to be sitting in frames. Maybe some code won't work without a frame to target, or you just simply like the look. Well, here's the code to stop people from taking your page out of a frames format:
This code sits after the <BODY> tag before any other text.
The code is, again, a conditional statement. The first line asks if the page, self, is equal to, ==, the top level page, parent.
If it isn't, meaning it is opening in a frame window, then nothing happens and the page loads as it normally would. But if it is the top level window, then three lines of code are written to the page using document.write() statements.
The first line simply alerts the use that the page is a frame element. The second tells the user he/she will be taken to a frame page in a second. The third line is a basic META REFRESH that loads the frame window.
I have this written in a very basic format. Here are a couple of things to make it better:
- You can jazz up the text anyway you want.
- If you set the META REFRESH to zero rather than 1, then the change will be almost instantaneous and the user might never see the text.
- You may want to put a link to the frame page in one of the lines of text in case the user's browser doesn't understand the META command.
ExamplesOK! I have a two-window frame page set up. The page that appears in the top frame offers a link to a page that will not allow itself to appear in a frame setting.
The page that appears in the bottom frame window has a link to a page that will not allow itself to appear outside of a frame setting.
HINT: You may want to do the one on the bottom first, when a page opens in a window by itself using this code, your back button doesn't work real well. The page just keeps opening itself up. You'll need to right click on the BACK button to get your history list, then choose the tutorial. It'll be clearly marked.
That's That!OK, you decide. Do you stay in a frames setting or do you get out? Your choice. Now no one can force you.
IT Solutions Builder TOP IT RESOURCES TO MOVE YOUR BUSINESS FORWARD
Which topic are you interested in?
What is your company size?
What is your job title?
What is your job function?
Searching our resource database to find your matches...