1

I was looking at a lecture of clickjacking and when I tried to create an iframe to go to website, I noticed that websites with no https are able vulnerable to clickjacking. Is there another way to stop clickjacking without SSL or do you need to use something else?

  • 1
    I think you need to investigate clickjacking a bit more - you can certainly clickjack https websites, and there are some standard methods to prevent it - top google result is owasp.org/index.php/Clickjacking – Matthew Apr 21 '17 at 15:37
4

There is an anti ClickJacking HTTP header you can add to your responses.

X-Frame-Options: DENY
X-Frame-Options: SAMEORIGIN
X-Frame-Options: ALLOW-FROM https://example.com/

Deny will stop the content loading into a frame, iframe or object, Same Origin will allow loading into pages on the same domain, 'Allow From' allows you to specify URIs that may frame your content.

The browser implements support for this, so there is a reliance on the user using a browser that complies with the header, though major browsers have supported this for a while- support is in place for IE11, Edge14 and Chrome 49.

You should configure your webserver to add this HTTP header to responses

You can also use frame ancestors if you are using a Content Security Policy.

  • 1
    X-Frame-Options is deprecated (actually was never made into standard), the proper, modern way to do this is via CSP. If you are worried about old, non-compliant browsers, you need to implement framebuster code anyway. – AviD May 19 '17 at 12:52
3

A website prevents clickjacking by preventing untrusted origins from embedding the site in a frame.

The established and reliable way to achieve this is to send an X-Frame-Options header. If you have no intention of having you page embedded in a frame of any origin, you can set it to DENY:

X-Frame-Options: DENY

Other options are SAMEORIGIN for access from the same domain and ALLOW-FROM to specify permitted domains.

The more modern (but not as widely supported) way to prevent clickjacking is sending a CSP header with the frame-ancestors directive. Setting it to none has roughly the same effect as X-Frame-Options: DENY:

Content-Security-Policy: frame-ancestors 'none';

You can find all common anti-clckjacking techniques in OWASP's Clickjacking Defense Cheat Sheet.

  • X-Frame-Options is deprecated (actually was never made into standard), the proper, modern way to do this is via CSP. If you are worried about old, non-compliant browsers, you need to implement framebuster code anyway. – AviD May 19 '17 at 12:53
  • @AviD I already referenced the modern CSP solution in my answer. But since it's not as widely supported as XFO I wouldn't recommend people to drop XFO right now. – Arminius May 19 '17 at 12:58
  • It's 2017. Any modern browser supports CSP, or at least enough of a subset to cover this usecase. XFO is done. – AviD May 19 '17 at 14:43
  • @AviD IE11 doesn't support the directive. Despite not being a modern browser it still has a global share of >3%. Personally, I don't care too much about supporting outdated browsers but for a big site there are definitely legitimate use cases to keep XFO. – Arminius May 19 '17 at 15:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.