New Google Chrome security features
The latest release of Google Chrome has integrated five new security features that “make it easier for developers to build secure web sites,” writes Adam Barth, one of the software engineers working on the project:
1. ClickJacking Protection with X-Frame-Options
X-Frame-Options lets web sites defend themselves against clickjacking attacks. To do this, the web developer includes the X-Frame-Options: deny HTTP header, which makes sure that the webpage doesn’t get loaded inside a frame, making it impossible for attackers to conceal malicious links behind legitimate ones.
2. Reflective XSS Protection
This feature protects against a type of cross-site scripting attack. “The XSS filter checks whether a script that’s about to run on a web page is also present in the request that fetched that web page. If the script is present in the request, that’s a strong indication that the web server might have been tricked into reflecting the script,” describes Barth, and says that unlike in IE8 and NoScript, this filter is “integrated into WebKit, which Google Chrome uses to render webpages”.
3. CSRF Protection via Origin Header
This feature was inserted to prevent cross-site request forgery attacks, making it impossible to trick the server into carrying out an action “requested” by a malicious site.
4. Strict-Transport-Security
Enables the browser to force a secure connection. It will always use HTTPS to connect to the site and will treat all HTTPS errors as hard stops (instead of prompting the user to “click through” certificate errors). This feature strengthens the browser’s defenses against attackers who control the network,” says Barth. “A number of high-security web sites have already started to use the feature, including PayPal. As with all of our security improvements, we hope that every browser will adopt Strict-Transport-Security, making the web, as a whole, more secure.”
5. Cross-Origin Communication with postMessage
postMessage provides a richer interaction and more secure communication between frames, and enables the creation of more secure versions of existing gadgets.