2

I was looking at a lecture of clickjacking and when I tried to create an iframe to go to website, I noticed that websites with no https are able vulnerable to clickjacking. Is there another way to stop clickjacking without SSL or do you need to use something else?

1
  • 1
    I think you need to investigate clickjacking a bit more - you can certainly clickjack https websites, and there are some standard methods to prevent it - top google result is owasp.org/index.php/Clickjacking
    – Matthew
    Commented Apr 21, 2017 at 15:37

2 Answers 2

4

There is an anti ClickJacking HTTP header you can add to your responses.

X-Frame-Options: DENY
X-Frame-Options: SAMEORIGIN
X-Frame-Options: ALLOW-FROM https://example.com/

Deny will stop the content loading into a frame, iframe or object, Same Origin will allow loading into pages on the same domain, 'Allow From' allows you to specify URIs that may frame your content.

The browser implements support for this, so there is a reliance on the user using a browser that complies with the header, though major browsers have supported this for a while- support is in place for IE11, Edge14 and Chrome 49.

You should configure your webserver to add this HTTP header to responses

You can also use frame ancestors if you are using a Content Security Policy.

1
  • 1
    X-Frame-Options is deprecated (actually was never made into standard), the proper, modern way to do this is via CSP. If you are worried about old, non-compliant browsers, you need to implement framebuster code anyway.
    – AviD
    Commented May 19, 2017 at 12:52
3

A website prevents clickjacking by preventing untrusted origins from embedding the site in a frame.

The established and reliable way to achieve this is to send an X-Frame-Options header. If you have no intention of having you page embedded in a frame of any origin, you can set it to DENY:

X-Frame-Options: DENY

Other options are SAMEORIGIN for access from the same domain and ALLOW-FROM to specify permitted domains.

The more modern (but not as widely supported) way to prevent clickjacking is sending a CSP header with the frame-ancestors directive. Setting it to none has roughly the same effect as X-Frame-Options: DENY:

Content-Security-Policy: frame-ancestors 'none';

You can find all common anti-clckjacking techniques in OWASP's Clickjacking Defense Cheat Sheet.

4
  • X-Frame-Options is deprecated (actually was never made into standard), the proper, modern way to do this is via CSP. If you are worried about old, non-compliant browsers, you need to implement framebuster code anyway.
    – AviD
    Commented May 19, 2017 at 12:53
  • @AviD I already referenced the modern CSP solution in my answer. But since it's not as widely supported as XFO I wouldn't recommend people to drop XFO right now.
    – Arminius
    Commented May 19, 2017 at 12:58
  • It's 2017. Any modern browser supports CSP, or at least enough of a subset to cover this usecase. XFO is done.
    – AviD
    Commented May 19, 2017 at 14:43
  • @AviD IE11 doesn't support the directive. Despite not being a modern browser it still has a global share of >3%. Personally, I don't care too much about supporting outdated browsers but for a big site there are definitely legitimate use cases to keep XFO.
    – Arminius
    Commented May 19, 2017 at 15:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .