I have read and seen that javascript framekiller code doesn't seem to be widely espoused as a panacea solution. It's target use case seems to primarily be for legacy browsers or old browser versions that don't support X-Frame-Options.
I am not sure if I am reading this page correctly: https://caniuse.com/?search=X-FRAME-OPTIONS but at the bottom only 49.46% of users support the SAME-ORIGIN option?
Instructions on OWASP site Dec 2020:
First apply an ID to the style element itself:
<style id="antiClickjack">
body{display:none !important;}
</style>
Then, delete that style by its ID immediately after in the script:
<script type="text/javascript">
if (self === top) {
var antiClickjack = document.getElementById("antiClickjack");
antiClickjack.parentNode.removeChild(antiClickjack);
} else {
top.location = self.location;
}
</script>
I note that this looks similar to the recommended code in the 2010 Busting Frame Busting: a Study of Clickjacking Vulnerabilities on Popular Sites by Gustav Rydstedt, Elie Bursztein, Dan Boneh and Collin Jackson. https://crypto.stanford.edu/~dabo/pubs/papers/framebust.pdf
Can this javascript framekiller code be (easily) circumvented like some of the examples in this paper?