Clickjacking remediation via domain name comparison
<p>I'm working on hardening our application to cross frame scripting/clickjacking attacks. Our application is hosted under multiple, different parent sites within an iframe. Each of these parent sites shares the same high level domain name (ex. *.foo.com).  I would like be able to ensure that the parent, framing site is always the same as our application domain.  For example:</p>

<p>Parent sites: apple.foo.com, pear.foo.com, banana.foo.com
Our site: mysite.foo.com</p>

<p>I know I can do something like this via Javascript but I would prefer not to embed our domain name within the code for portability reasons.</p>

<pre><code>&lt;script type="text/javascript"&gt;
var topFrameHostname = "";
try
{
                topFrameHostname = top.location.hostname;
}
catch (err)
{
                topFrameHostname = "";
}
if (self !== top &amp;&amp; document.referrer.match(/^https?:\/\/([^\/]+\.)?foo\.com(\/|$)/i)) == null &amp;&amp; 
                topFrameHostname != self.location.hostname) 
{
                top.location = self.location;
} 
else
{
                var antiClickjack = document.getElementById("antiClickjack");
                antiClickjack.parentNode.removeChild(antiClickjack);
}
&lt;/script&gt;
</code></pre>

<p>So my question is can I use regular expressions to compare the domain name from the <code>top.location</code> and <code>self.location</code> values?  This way I would be able to ensure it is always only a parent site from the same high level domain framing our application. Looking for a little help with the regular expression coding. Is this approach sound?</p>