Clickjacking
A page loads the target site in a hidden or disguised frame and tricks the user into clicking it (CWE-1021). Prevent framing with the CSP frame-ancestors directive or X-Frame-Options.
- Fix it in your stack
- Clickjacking fix cards (4 stacks) · CWE-1021 page
- Defined in
- MITRE CWE-1021
Covered in
Guide
Configure HTTP security headers from a tested baseline
Send the response headers that make browsers enforce HTTPS, run only your own scripts, refuse hostile framing and keep cookies on one host, then prove they appear on every kind of response.
Guide
Configure CORS and CSP around the browser capabilities you need
Control who can read API responses and which resources a page may execute without confusing either control with authorization.
Practice: CORS policy lab: Grant CORS to the right origins only · CSP builder lab: Build a strict Content-Security-Policy