151 reputation
3
bio website
location
age
visits member for 1 year, 5 months
seen Dec 8 '13 at 2:44

Dec
8
answered Steps to troubleshoot new Nginx installation
Oct
2
awarded  Teacher
Feb
8
comment Nginx - prevent a .php file running on anything but your own server/domain?
top.window may become easy to circumvent with the sandbox attribute. X-Frame will prevent embedding in most current browsers (it was made just for that, as embedding can be a security risk), so it is the way to go. It will certainly suffice to prevent people from embedding your player. They may "steal" it in other ways, but that is way beyond this comment. I'd suggest to deal with when it happens, it if it ever happens. (Sidenote: Please remember to vote on answers and accept one of them if your problem is solved.)
Feb
8
comment Nginx - prevent a .php file running on anything but your own server/domain?
It probably isn't caused by an Ajax refresh, but something else. Referer is unreliable because some users and some internet security suites disable it for privacy reasons. A referer can be "faked" to look blank (i.e. as if the user disabled it) with moderate effort. While it is a sufficent tool to make content stealing more difficult, it is unsuitable for security purposes like to detect a user is already logged in, and I suspect the PHP warning is about that.
Feb
8
comment Nginx - prevent a .php file running on anything but your own server/domain?
Currently, there are two copies of the SAMEORIGIN header. You can see this if you click the request on the network tab of the chrome web developer tools.
Feb
7
awarded  Editor
Feb
7
revised Nginx - prevent a .php file running on anything but your own server/domain?
added 132 characters in body
Feb
7
comment Nginx - prevent a .php file running on anything but your own server/domain?
The header is sent three times. Make sure it is sent exactly once, or some browsers (Chrome, notably, as well as older Firefox versions) will ignore it. It works correctly (i.e. the player does not work) in current Firefox. Added that to the answer.
Feb
7
comment Nginx - prevent a .php file running on anything but your own server/domain?
What do you mean by "calling a PHP plugin to run in an iframe"? There is an <iframe src="http://xxx"> somewhere. Whatever URL is in the src attribute must be delivered with the header. If that iframe then contains other ressources (probably including iframes), their headers are irrelevant. Just post an URL with an example please...
Feb
7
comment Nginx - prevent a .php file running on anything but your own server/domain?
Enable error reporting <?php error_reporting(E_ALL); ?> to make sure you don't miss errors like "headers already sent". You need to include the header command in front of ANYTHING else, including invisible byte-order-marks many editors add to UTF8 files.
Feb
6
comment Nginx - prevent a .php file running on anything but your own server/domain?
Which browser are you using to test? Are you sure the header is being delivered? (Check with Wireshark, Firebug or the equivalent built-in tool in Firefox/Chrome.)
Feb
6
answered Nginx - prevent a .php file running on anything but your own server/domain?
Feb
6
answered Can Netcat talk to an encrypted port?
Jan
24
awarded  Supporter