Frame Counting

web security

Definition

Frame Counting

Frame counting is an XS-Leak that reads the number of iframes a cross-origin page opens. After const win = window.open('https://www.linkedin.com'), the attacker consults win.length once the page has loaded — a value that depends on the user’s logged-in state, because an authenticated page renders more frames. The count therefore leaks a bit of auth state.

SameSite=Lax does not stop this

window.open is a top-level navigation, and Lax cookies are attached to top-level cross-site navigations. So the cross-site page loads authenticated, the iframe count varies with auth state, and a Lax-protected site still leaks. SameSite mitigates some XS-Leaks but not this one because the threat model — a boolean oracle, not a CSRF — does not require the attacker to forge a request, only to load the page.