How can we prevent a clickjacking attack using iframes etc. in .Net MVC core application?
If your application is hosted with IIS you can activate the X-Frame-Options header in web.config.
<httpProtocol> <customHeaders> <add name="X-Frame-Options" value="DENY" /> </customHeaders> </httpProtocol>
Other ways for using X-Frame-Options are described here.
A more modern approach would be using the Content Security Policy.
Content-Security-Policy: frame-ancestors 'none';
For older browsers which don't understand these headers you could also use a framekiller script, but this is outdated and not always completely secure.
One way is adding the HTTP headers in to your response as decribed in other answer. This is common to any Web application and following are the options you can use.
- DENY :
- SAMEORIGIN : Allow only to your domain
- ALLOW-FROM : You can specify any domain to allow
Since you have asked about .Net Core specifically , following is the way you can implement security in your middleware.
You can use any option in your middle ware this way in your code.