0

Given a website which doesn't use any protection specifically against Clickjacking (no X-Frame-Options or CSP), but which does access an attribute of top in essential JavaScript code, eg:

// http://localhost/jack.html
<script>
var foo = top.something;
console.log('processing: ' + foo);

loadPage();
function loadPage() {
    document.write('the page');
}
</script>

The JavaScript code must run, otherwise the page wouldn't be displayed. But it's not important what something actually is, as it's not essential for displaying the page.

This page can be accessed directly, and it can be framed from the same origin:

<script>
window.something = 'test';
</script>
<iframe style="opacity: 20;" height="1400" width="1400" scrolling="no" src="http://localhost/jack.html"></iframe>

But it cannot be framed from a different origin, because accessing window.something across origin is clearly not allowed, so then the rest of the JavaScript code will not be executed, and the page will not be displayed.

The usual framebusting-busting techniques wouldn't work here. But would this page be secure from Clickjacking attacks, or are there ways to still successfully frame it (eg by somehow allowing access to the window.something attribute, by causing a non-blocking error on accessing the attribute, etc)?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.