Clickjacking and framing controls
Clickjacking tricks a person into interacting with a page through an unexpected or disguised frame.
What it means
Clickjacking tricks a person into interacting with a page through an unexpected or disguised frame. The real application may receive a legitimate-looking click even though the surrounding page misled the user. Framing controls help a site declare which ancestors may embed its pages.
A practical example
An account page changes a sensitive setting with one click. A malicious site could overlay misleading content around an embedded version. The application restricts framing and also requires appropriate confirmation for the sensitive operation.
What to check
Review Content Security Policy frame-ancestors and compatible framing protections. Test direct navigation and legitimate embedded workflows, including whether every sensitive document returns the intended headers.
A common pitfall
Client-side frame-busting code is not a reliable substitute for browser-enforced response policies. A page requiring login can still be vulnerable when the user is already signed in.
Think it through
Why does authentication fail to stop a misleading framed button?
Answer: The victim's authenticated browser is clicking the real page; the problem is the deceptive presentation around it.
Presentation changes the meaning of a click
Imagine a fictional expense service whose approval screen can be embedded by any website. A user might see a misleading visual layer while clicking the genuine service underneath. The application receives an ordinary interaction from an authenticated browser, but the person did not understand what that interaction would approve. This is why the display context belongs in the security model.
Framing policy should reflect real product requirements. A support widget may intentionally be embedded by a small set of partner sites; an account recovery page usually has a different need. Define the permitted ancestors for each sensitive document instead of applying a permissive wildcard to make every integration work. Review nested frames as well as the immediate parent.
The response that delivers the page must carry the intended policy. A reverse proxy, static host, or error page can alter coverage. Checking only the main application route may miss a separate approval document or an older deployment. Browser inspection of response headers and actual embedding behavior provides more useful evidence than finding a configuration line in a repository.
Review both protection and usability
Create a harmless local page with a dummy approval button and a separate frame host. Observe how a restrictive framing policy changes whether the page can be embedded. Then list any legitimate host that the real product would need to support and document why.
For high-impact actions, clearly display the action details and require a meaningful confirmation. A framing rule addresses one presentation mechanism, not every way a person can be misled through windows or navigation. Retest supported browsers and partner flows after configuration changes. The goal is to keep sensitive interaction in an understandable context without silently weakening the site's embedding boundary.
Related concepts
References & further reading
Original explanations, with primary references for deeper study.
OWASP: Clickjacking Defense