CSS overlays and frame breakers

I (wrongly) assumed that Javascript frame breakers were ineffective when using iframes on IE when using the security=restricted attribute. As it turns out cookies are not allowed by default when using the attribute because the security settings are applied from IE restricted zone. My recommendation is to use frame breakers on administration pages and other sensitive actions to prevent iframe inclusion of a page without the users knowledge.

Big thanks to Ambush commander on the sla.ckers forums for the info, check out his CSRF magic script which provides automagic protection for your PHP scripts. Mario also provides an alternative which is specific to PHP5 also automagic :)

So in summary frame breakers won't protect against all CSRF attacks using iframes but do provide good protection against CSS overlays when using cookies.