Framebusting on 3rd party sites break Cypress automation

[brian-mann]

Sites that implement old school security measures such as clickjacking or framebusting break Cypress.

[brian-mann]

A study of common framebusting / clickjacking techniques.

https://seclab.stanford.edu/websec/framebusting/framebust.pdf

We will likely implement enough to cover the bases described here on page 3

unique sites	conditional statement
38%	if (top != self)
22.5%	if (top.location != self.location)
13.5%	if (top.location != location)
8%	if (parent.frames.length > 0)
5.5%	if (window != top)
5.5%	if (window.top !== window.self)
2%	if (window.self != window.top)
2%	if (parent && parent != window)
2%	if (parent && parent.frames && parent.frames.length>0)
2%	if((self.parent&&!(self.parent===self))&&(self.parent.frames.length!=0))

[brian-mann]

Released in 2.0.0.

[miohtama]

I have encountered a script that is not correctly fixed by the current Cypress network layer modification. What would be the best place to discuss how to update the framebuster support to cover this?

Specifically, it is a Xsolla login iframe https://xsolla.com/products/login

[jennifer-shehane]

@miohtama Please open a new issue with a fully reproducible example that we can run. There may be a specific edge case with the issue that we need more detail to fix.