Clickjacking: Hidden clicks on other people’s pages

In short: An attack in which a real page lies invisibly over a bait page so that the user unintentionally clicks its buttons.

In more detail: The attacker embeds the target page in a transparent <iframe> and places it over a harmless-looking page (“Win a phone!”). Whoever clicks the bait actually triggers an action on the target page, such as “delete account” or “buy”, using their existing sign-in.

In Depth

How it works

Using CSS the iframe is made invisible with opacity: 0 and shifted so that the dangerous button lies exactly under the bait. The user only sees the bait, clicks, and the browser passes the click to the target page above it. One variant is called likejacking (an unnoticed “like”), another cursorjacking.

Protection: forbid embedding

The target page must tell the browser that it may not appear in foreign frames:

Content-Security-Policy: frame-ancestors 'none'
X-Frame-Options: DENY

frame-ancestors is the modern way and also allows targeted exceptions, such as frame-ancestors 'self' https://partner.example. X-Frame-Options is the older header and is set in addition.

Further measures

Cookies with SameSite=Lax or Strict prevent the sign-in from being sent along in a foreign frame. For particularly critical actions an extra confirmation (password, two-factor) protects. Frame-busting scripts in JavaScript are regarded as unreliable and do not replace the headers.

Checking

With the browser’s developer tools (network tab) you can check whether the response contains the headers mentioned. Many security scanners report missing protection against clickjacking.

See also: Security headers, Content Security Policy, XSS