{"action":"closed","issue":{"url":"https://api.github.com/repos/untitaker/mysteryshack/issues/10","labels_url":"https://api.github.com/repos/untitaker/mysteryshack/issues/10/labels{/name}","comments_url":"https://api.github.com/repos/untitaker/mysteryshack/issues/10/comments","events_url":"https://api.github.com/repos/untitaker/mysteryshack/issues/10/events","html_url":"https://github.com/untitaker/mysteryshack/issues/10","id":115758907,"number":10,"title":"Preventing clickjacking during OAuth","user":{"login":"untitaker","id":837573,"avatar_url":"https://avatars.githubusercontent.com/u/837573?v=3","gravatar_id":"","url":"https://api.github.com/users/untitaker","html_url":"https://github.com/untitaker","followers_url":"https://api.github.com/users/untitaker/followers","following_url":"https://api.github.com/users/untitaker/following{/other_user}","gists_url":"https://api.github.com/users/untitaker/gists{/gist_id}","starred_url":"https://api.github.com/users/untitaker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/untitaker/subscriptions","organizations_url":"https://api.github.com/users/untitaker/orgs","repos_url":"https://api.github.com/users/untitaker/repos","events_url":"https://api.github.com/users/untitaker/events{/privacy}","received_events_url":"https://api.github.com/users/untitaker/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/untitaker/mysteryshack/labels/security","name":"security","color":"fbca04"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-11-08T20:46:09Z","updated_at":"2015-11-08T23:59:45Z","closed_at":"2015-11-08T23:59:45Z","body":"https://tools.ietf.org/html/rfc6749#section-10.13\r\n\r\nIdeally we'd implement both JS framebreaker and X-Frame-Options.\r\n\r\nSandboxed iframes allow the attacker to disable all JS (which means disabling framebreakers). Mitigations:\r\n\r\n* Assume that sandbox-supporting browsers also support X-Frame-Options\r\n* Require JS on web UI, intentionally break if JS is disabled."}}