2 added 103 characters in body
source | link

Happened to come across this question and figured I'd chip in to clarify what the problem is with that test. It's not really incorrect, but it only accounts for the clickjacking defense script that is mentioned on the page. It does not take into account the X-FRAME-OPTIONS header defense.

If you perform that test there are a couple of things that could happen:

  • The clickjack text disappears: This means that there is a javascript defense, and that there either is no header defense or your browser doesn't support it.
  • The clickjack text is still there but nothing is shown in the iframe: This means that there is a header defense, and your browser supports it. You can't tell if the javascript defense is implemented because the iframe page is never loaded.
  • The clickjack text is still there, and the site loaded in the iframe: This means that there is no javascript defense, and that there either is no header defense or your browser doesn't support it.

As the second options shows, the page can be properly protected but you still see the clickjack text. To be sure, it's probably best to perform the test with both a modern and older browser without X-FRAME-OPTIONS support.

Naturally, it's best to implement both defenses should be implemented. The header defense is aimed towards modern browsers, while the javascript defense protects legacy browsers.

Check out https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet for more information.

Happened to come across this question and figured I'd chip in to clarify what the problem is with that test. It's not really incorrect, but it only accounts for the clickjacking defense script that is mentioned on the page. It does not take into account the X-FRAME-OPTIONS header defense.

If you perform that test there are a couple of things that could happen:

  • The clickjack text disappears: This means that there is a javascript defense, and that there either is no header defense or your browser doesn't support it.
  • The clickjack text is still there but nothing is shown in the iframe: This means that there is a header defense, and your browser supports it. You can't tell if the javascript defense is implemented because the iframe page is never loaded.
  • The clickjack text is still there, and the site loaded in the iframe: This means that there is no javascript defense, and that there either is no header defense or your browser doesn't support it.

As the second options shows, the page can be properly protected but you still see the clickjack text. To be sure, it's probably best to perform the test with both a modern and older browser without X-FRAME-OPTIONS support.

Naturally, it's best to implement both defenses.

Check out https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet for more information.

Happened to come across this question and figured I'd chip in to clarify what the problem is with that test. It's not really incorrect, but it only accounts for the clickjacking defense script that is mentioned on the page. It does not take into account the X-FRAME-OPTIONS header defense.

If you perform that test there are a couple of things that could happen:

  • The clickjack text disappears: This means that there is a javascript defense, and that there either is no header defense or your browser doesn't support it.
  • The clickjack text is still there but nothing is shown in the iframe: This means that there is a header defense, and your browser supports it. You can't tell if the javascript defense is implemented because the iframe page is never loaded.
  • The clickjack text is still there, and the site loaded in the iframe: This means that there is no javascript defense, and that there either is no header defense or your browser doesn't support it.

As the second options shows, the page can be properly protected but you still see the clickjack text. To be sure, it's probably best to perform the test with both a modern and older browser without X-FRAME-OPTIONS support.

Naturally, both defenses should be implemented. The header defense is aimed towards modern browsers, while the javascript defense protects legacy browsers.

Check out https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet for more information.

1
source | link

Happened to come across this question and figured I'd chip in to clarify what the problem is with that test. It's not really incorrect, but it only accounts for the clickjacking defense script that is mentioned on the page. It does not take into account the X-FRAME-OPTIONS header defense.

If you perform that test there are a couple of things that could happen:

  • The clickjack text disappears: This means that there is a javascript defense, and that there either is no header defense or your browser doesn't support it.
  • The clickjack text is still there but nothing is shown in the iframe: This means that there is a header defense, and your browser supports it. You can't tell if the javascript defense is implemented because the iframe page is never loaded.
  • The clickjack text is still there, and the site loaded in the iframe: This means that there is no javascript defense, and that there either is no header defense or your browser doesn't support it.

As the second options shows, the page can be properly protected but you still see the clickjack text. To be sure, it's probably best to perform the test with both a modern and older browser without X-FRAME-OPTIONS support.

Naturally, it's best to implement both defenses.

Check out https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet for more information.