I have a doubt regarding the use of the Content Security Policy (CSP) as protection mechanism against clickjacking.
I have created an online Proof of Concept (PoC) on a web page where I put a button that loads the URL that is specified in an input field which is up and running on a server. This PoC is to test if a site is vulnerable or not, and based on that, I have tested a site which is using CSP to prevent clickjacking attacks. The result on my online PoC tell me that the site is not vulnerable because I'm not able to framing it, however, if I repeat the test using the static template provided in the OWASP site, then I'm able to see the content of the web page within the element.
So, I feel that the site may still be vulnerable, and I would like to know your opinion.
I noticed that the CSP is not returned in the header when I use the static PoC, do you believe that the this an error in programming which makes vulnerable the site?
Has anyone experienced this before?