Editorial: Tone down X-Frame-Options obsoletion message

[tunetheweb]

Fixes #10936

As per #10936 (comment) this was likely added through a misunderstanding of the CSP spec wording.

• At least two implementers are interested (and none opposed):
  • There are non plans to remove X-Frame-Options from any browsers (at least no public positions on this that I'm aware of) and doing so would likely be a downgrade in security for no real benefit.
• Tests are written and can be reviewed and commented upon at:
  • N/A
• Implementation bugs are filed:
  • Chromium: N/A
  • Gecko: N/A
  • WebKit: N/A
  • Deno (only for timers, structured clone, base64 utils, channel messaging, module resolution, web workers, and web storage): …
  • Node.js (only for timers, structured clone, base64 utils, channel messaging, and module resolution): …
• Corresponding HTML AAM & ARIA in HTML issues & PRs: N/A
• MDN issue is filed: Undeprecate X-Frame-Options mdn/browser-compat-data#25663
• The top of this comment includes a clear commit message to use.

(See WHATWG Working Mode: Changes for more details.)

---

/document-lifecycle.html ( diff )

[domenic]

I'm fine with this change, although I guess the discussion is still ongoing so I'll tag "do not merge yet" until we have everyone on the same page.

[annevk]

This seems reasonable, but I think we should change CSP at the same time to also use less confusing wording.

[tunetheweb]

This seems reasonable, but I think we should change CSP at the same time to also use less confusing wording.

Do you mean the CSP spec? I already raised w3c/webappsec-csp#702 to do just that.

[annevk]

Thanks!