What is clickjacking?

Clickjacking, also called UI redressing, overlays a visible interface with a transparent or disguised page from another site. The user believes they are clicking a harmless element, but actually activates a control in the embedded application.

How does clickjacking work?

The attacker loads the target in an iframe, positions it precisely over decoy elements with CSS and makes it nearly transparent. Mouse or touch input reaches the frame. If the victim is authenticated to the target, the click may execute an authenticated action. Unlike CSRF, genuine user interaction is required; in return, clickjacking can influence actions that contain unpredictable form values.

Which variants exist?

What impact is realistic?

Possible effects include changing settings, granting permissions, activating a camera, initiating a payment or connecting an account. Risk depends on which function can be reached with a few predictable interactions and whether further confirmation is required. An arbitrary informational page that permits framing is therefore not automatically a meaningful security finding.

How is clickjacking prevented?

• Content-Security-Policy: frame-ancestors 'none' prevents all framing.
• frame-ancestors 'self' or a narrow origin list permits intentional frames.
• X-Frame-Options: DENY or SAMEORIGIN supports older browsers.
• Sensitive actions require understandable, contextual confirmation or reauthentication.
• Cookie attributes and CSRF controls limit combined attack paths.

CSP frame-ancestors is the flexible modern control. It must be delivered as an HTTP response header; a meta tag is insufficient. If partner portals are intentionally permitted, only exact trusted origins should be listed.

Configuration example: block framing with response headers

Content-Security-Policy: frame-ancestors 'none'
X-Frame-Options: DENY

If a page intentionally appears inside a partner portal, use that exact trusted origin in frame-ancestors instead of a wildcard. The headers must also cover error pages, login pages and sensitive subpages.

Why is frame busting insufficient?

Older pages use JavaScript such as if (top !== self) to escape frames. These scripts can be bypassed through sandbox attributes, disabled JavaScript, nested frames or flawed browser logic. Browser-enforced headers act earlier and more reliably. JavaScript can only be an additional layer.

How is clickjacking tested?

Testers inspect headers on all relevant responses, not just the home page. They then attempt to embed sensitive functions in an external test page and overlay their controls precisely. Multi-step dialogs, mobile views, different subdomains and intentionally permitted partner frames are considered separately. The proof uses a harmless test action.