VibeSecurity

Web attacks

What is Clickjacking?

Clickjacking is an attack where a malicious site loads your page inside an invisible frame and tricks a visitor into clicking a real button on it, such as delete, pay or approve, while they think they are clicking something else.

A browser can show one website inside another using an iframe. In a clickjacking attack, the attacker builds a decoy page, places your app on top of it in a transparent frame, and lines up one of your buttons with something tempting on the decoy. The visitor is logged in to your app, so the click counts as a genuine action taken by them.

The attacker never sees your page or steals a password. They only borrow one click, which is enough for actions that need a single press: confirming a transfer, granting a permission, changing a setting or deleting an account. AI-built apps are exposed by default because most frameworks and hosts do not send any anti-framing header unless you add one.

The fix is to tell browsers who may frame your pages. Send a Content-Security-Policy header with the frame-ancestors directive, and add X-Frame-Options as well for older browsers. Setting session cookies with SameSite Lax or Strict also helps, because the framed page then loads without the visitor's session.

Headers that forbid framing by other sites
Content-Security-Policy: frame-ancestors 'self'
X-Frame-Options: SAMEORIGIN

Go deeper

Related terms

Sources

  1. 1.MDN: Clickjacking
  2. 2.OWASP Clickjacking Defense Cheat Sheet