Web SecurityMediumUI redressing
Clickjacking (UI Redressing)
An attacker frames your site invisibly and tricks users into clicking sensitive controls.
Overview
Without framing protections, a transparent iframe of the target is overlaid on attacker UI; the victim’s clicks land on the target’s buttons (e.g., “delete account”, “authorize app”).
How it works
Without framing protections, a transparent iframe of the target is overlaid on attacker UI; the victim’s clicks land on the target’s buttons (e.g., “delete account”, “authorize app”).
Example
Impact
Unintended state changes, OAuth consent hijacking, and like/follow fraud.
Detection
Check responses for X-Frame-Options / CSP frame-ancestors and attempt to frame sensitive pages.
Prevention
- Set CSP frame-ancestors to a strict allowlist (or none).
- Send X-Frame-Options: DENY/SAMEORIGIN as a fallback.
- Require re-authentication for highly sensitive actions.