Clickjacking: clicks on a page the user cannot see

Definitions follow OWASP and CWE-1021.

1. The attacker builds a decoy page. A game, a prize, a video with a play button.
2. Your page is loaded in a frame on top of it, made transparent and positioned so your button sits exactly under the decoy's.
3. The user clicks the decoy. The click goes to your page, in the user's signed-in session.
4. Your site carries out the action. From its point of view the user clicked a real button on a real page.

Variants move the frame with the pointer, ask for several clicks in sequence, or drag text into a form. All of them depend on one thing: your page agreeing to be framed by another site.

• Changing settings. A privacy or email setting switched by a single hidden click.
• Confirming an action. A purchase, transfer or deletion that needs only one confirmation click.
• Granting permissions. Camera, microphone or account access approved on a page the user cannot see.
• Social actions. A follow, like or share that spreads the decoy further.

The common pattern is an action that needs no typing and no second step, which is also the first thing to protect.

Before browsers supported headers for this, sites added scripts that checked whether the page was framed and, if so, replaced the outer page. These frame-busting scripts can be defeated: the framing page can sandbox the frame so scripts do not run, or interfere with navigation so the replacement never happens.

Headers do not have that weakness, because the browser enforces them before the page renders. Keep a script only as a fallback for very old browsers, never as the main defence.

1. Send frame-ancestors. Content-Security-Policy: frame-ancestors 'self' stops other sites framing your pages; list partner origins if they need to embed you. See frame-ancestors on MDN.
2. Send X-Frame-Options as well. X-Frame-Options: SAMEORIGIN for browsers that do not support the directive; see X-Frame-Options on MDN.
3. Set SameSite on session cookies. A framed page loaded from another site then often arrives without the session.
4. Confirm sensitive actions. Re-entering a password defeats a hidden click.

The OWASP Clickjacking Defense Cheat Sheet explains why script-based frame busting is not enough. Both headers are part of the set on HTTP security headers.

Check the response headers of a page with a sensitive action: if neither frame-ancestors nor X-Frame-Options is present, the page can be framed. You can confirm by creating a local HTML file with an iframe pointing to the page and opening it in a browser; if the page appears, it is frameable.

Test signed-in pages and error pages, not only the home page; headers set in one part of a site are often missing from another.