Clickjacking

Also Known As

TL;DR

Explanation

Clickjacking (UI redressing) loads a legitimate site in a transparent iframe positioned over a decoy page. The victim thinks they are clicking a harmless button on the attacker's page but are actually interacting with hidden elements on the legitimate site — liking posts, transferring funds, or changing settings. Prevention: set the X-Frame-Options: DENY (or SAMEORIGIN) response header, or use the Content-Security-Policy frame-ancestors directive. PHP: header("X-Frame-Options: DENY");

How It's Exploited

Common Misconception

Why It Matters

Common Mistakes

• Not setting X-Frame-Options or CSP frame-ancestors header — the page can be framed by anyone.
• Using X-Frame-Options: ALLOWALL which provides no protection.
• Implementing only JavaScript frame-busting code which is easily bypassed by sandbox attributes on the iframe.
• Forgetting to apply the header to all pages — attackers only need one frameable sensitive action.

Code Examples

// Missing frame protection header — page can be embedded in any iframe:
header('Content-Type: text/html');
// Should add: header('X-Frame-Options: DENY');
// Or: header("Content-Security-Policy: frame-ancestors 'none'");

// Prevent your page from being embedded in an iframe on another domain
header('X-Frame-Options: DENY');
// Or allow only same origin:
header('X-Frame-Options: SAMEORIGIN');

// Modern equivalent via CSP:
header("Content-Security-Policy: frame-ancestors 'none';");
// frame-ancestors 'self' — same as SAMEORIGIN but more flexible

References

• ↗ https://owasp.org/www-community/attacks/Clickjacking
• ↗ https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html
• ↗ https://cwe.mitre.org/data/definitions/1021.html

Tags

Related Terms