Problem
a) What is the common idea behind the X-Frame-Options and CSP mechanisms? Why is it effective in defeating the Clickjacking attack?
b) When a host page puts a page inside an iframe, can the host page access the content inside the iframed page?
c) The following JavaScript code displays content inside a page. The content comes from an untrusted place. If the content, which is supposed to be data only, contains JavaScript code, can the code be executed? Why?
const iframe = document.createElement("iframe"); iframe.srcdoc = content;
iframe.sandbox = ""; document.body.appendChild(iframe);