Beginner LevelWeb Security & Cyber Defense
What is Clickjacking and how do X-Frame-Options and CSP frame-ancestors prevent it?
❓ Interview Prompt: Explain Clickjacking (UI Redressing), transparent iframe overlays, `X-Frame-Options: DENY`, and CSP `frame-ancestors` directive.
Clickjacking (UI Redressing) tricks users into clicking transparent '<iframe>' buttons layered over an innocent-looking decoy webpage:
Attack Mechanics:
An attacker embeds 'https://bank.com/transfer' inside a transparent '<iframe>' on 'http://evil.com'. The attacker positions an enticing "Claim Free Gift" button directly over the bank's "Confirm Transfer" button!
Defenses:
1
'X-Frame-Options: DENY': Tells browser never to allow embedding the page inside any '<frame>' or '<iframe>'.
2
CSP 'frame-ancestors 'none'': Modern directive specifying allowed parent domains.
Code Implementation Example
http
HTTP/1.1 200 OK
Content-Type: text/html
X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none';💡Header response forbidding iframe framing to prevent Clickjacking.
🎯 Interview Key Takeaway
Set X-Frame-Options: DENY and CSP frame-ancestors 'none' to prevent attackers from embedding pages inside transparent iframe overlays.
#Clickjacking#X-Frame-Options#Headers#Beginner
Back to all Web Security & Cyber Defense Questions→