search

w3c / webappsec-post-spectre-webdev

Post-Spectre Web Development
https://w3c.github.io/webappsec-post-spectre-webdev/
Other
17 stars 3 forks source link

Is there any benefit on explicitly setting default headers? #8

Closed shhnjk closed 3 years ago

shhnjk commented 3 years ago

X-Frame-Options: ALLOWALL Cross-Origin-Opener-Policy: unsafe-none

Is there any benefit on setting these? If so, maybe add an explanation?

mikewest commented 3 years ago

The core benefit is that it would enable us to more easily change the default (along the lines of https://github.com/mikewest/embedding-requires-opt-in). I'll add a note.