Clickjacking & CSP frame-ancestors

Also Known As

TL;DR

Explanation

Clickjacking (UI redressing) embeds a target site in a transparent iframe, positioned over a decoy page. The victim believes they are clicking the decoy UI but actually interact with the hidden target — completing a purchase, changing a password, or granting OAuth permissions. The modern defence is the Content-Security-Policy frame-ancestors directive: frame-ancestors 'none' disallows all framing; frame-ancestors 'self' permits same-origin only; frame-ancestors https://trusted.com restricts to named origins. X-Frame-Options (DENY or SAMEORIGIN) is the legacy equivalent supported by older browsers. CSP frame-ancestors takes precedence where supported and is more granular. PHP: add both headers in a middleware for defence-in-depth.

Common Misconception

Why It Matters

Common Mistakes

• Using X-Frame-Options DENY without also setting CSP frame-ancestors — older header is ignored by modern browsers in some contexts.
• Setting frame-ancestors 'self' when the page legitimately needs to be embedded by a partner domain — too restrictive.
• Not setting frame-ancestors at all when X-Frame-Options is the only protection — some browsers prioritise CSP.
• Deploying frame-ancestors only on sensitive pages and missing others that trigger sensitive actions.

Code Examples

// Only X-Frame-Options — no CSP frame-ancestors:
header('X-Frame-Options: DENY');
// Modern browsers may ignore this if CSP is present without frame-ancestors

// Complete protection:
header('X-Frame-Options: DENY');  // Legacy browsers
header("Content-Security-Policy: frame-ancestors 'none'");  // Modern browsers

header("Content-Security-Policy: frame-ancestors 'none'");
header('X-Frame-Options: DENY'); // legacy fallback

References

• ↗ https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html

Tags

Related Terms