Web Security & OWASP (50 Qs)•Part 4: Browser Security, HTTP Headers & Client Hardening (36 - 42)
Clickjacking & Frame Busting: How transparent iframe overlays work and frame-ancestors defenses.
Mechanics of Clickjacking (UI Redress Attack)
Clickjacking tricks a victim into clicking on an invisible, transparent <iframe> of a sensitive website (e.g. "Delete Account" or "Confirm Payment") while the victim believes they are clicking on a decoy button (e.g. "Play Game" or "Claim Prize").
ini
Attacker Page Structure (Layered Z-Index):
Top Layer (Opacity: 0.0001 - Invisible):
<iframe src="https://bank.com/transfer" style="position:absolute; z-index:2;"></iframe>
Bottom Layer (Visible Decoy):
<button style="position:absolute; z-index:1;">CLICK HERE TO WIN $1000!</button>
Victim clicks the visible prize button, but the click lands directly on the
underlying transparent bank transfer button!
The Modern Defense: CSP frame-ancestors
While the legacy header X-Frame-Options: DENY provided basic protection, it did not support multiple allowed parent domains or granular path rules. Modern applications use CSP Level 2/3:
http
# Block ALL framing from any website (Maximum Security):
Content-Security-Policy: frame-ancestors 'none';
# Allow framing ONLY by your own trusted portals:
Content-Security-Policy: frame-ancestors 'self' https://trusted-partner.com;