documentcloud/documentcloud — pull request #113 by adamhooper (2014-06-25 13:51:13+00:00)
Title: Disable SAMEORIGIN on login page.

This lets https://www.overviewproject.org display private DocumentCloud
documents to its users even when they aren't logged in to DocumentCloud.
The steps look like this:

1. User opens /documents/X in an iframe (no X-Frame-Options)
2. DocumentCloud sees it's a private document; it redirects to /login
3. (after this patch), the browser loads /login in the iframe
4. The user enters email/password
5. Login succeeds; DocumentCloud redirects to /documents/X

This does open DocumentCloud up to clickjacking. Blame WebKit: it's the
only browser that doesn't allow an ALLOW-FROM X-Frame-Options setting,
which would limit the iframe to https://www.overviewproject.org.
https://bugs.webkit.org/show_bug.cgi?id=94836#c13

From Overview's point of view, there are no reliable workarounds.