Requests, files, and servers
Stop clickjacking
Control which sites may frame a page and add confirmation for sensitive actions that should never be triggered through a disguised interface.
8 minute lesson
Clickjacking places a real page inside a deceptive frame and tricks the user into clicking it. The browser still sees a legitimate authenticated action.
Use CSP frame-ancestors and keep X-Frame-Options where legacy coverage matters. Require clear confirmation or recent authentication for destructive operations. Test embedding from a different origin.
A transparent frame places the real “Delete project” button under a fake “Play” button. The click is genuine from the application’s perspective.
Blocking every frame can break a product that intentionally embeds a dashboard for one partner. Use a narrow frame-ancestors allowlist when embedding is required.
Build a local attacker page that frames the sensitive route and show the attack before the header change. Afterward, capture the browser refusal and confirm any approved embedding origin still works.
Lesson completed