Re: [Full-disclosure] Clickjacking (?) on Facebook.com (Question)

[Michal Zalewski <lcamtuf@xxxxxxxxxxx>]

> Doesn't Google always send JSON with Content-Disposition: attachment or so
> because of that?

One of the reasons (there's also content sniffing, etc). But then,
consider view-source:, too - you can use it in Firefox to render the
source of a HTML page in a frame (Chrome no longer lets you use
view-source within frames).

/mz

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/