frame-ancestors directive support in CSP on cdn.ampproject.org to protect from ClickJacking attack

Currently in Google search results page AMP powered page is displayed inside iframe with source like https://foo-com.cdn.ampproject.org/c/s/foo.com/amp_document.html.. This source is for AMP cache. But this page also could be displayed in every other site inside such iframe (from AMP cache like cdn.ampproject.org), including malicious one. So there could be attack called Clickjacking.

Classic way to prevent such attack is to use X-Frame-Options: SAMEORIGIN HTTP response header in the web app. But AMP cache removes it because this iframe should be displayed from google.com (and it is not “same origin”). Another approach is to specify frame-ancestors directive in Content Security Policy. CSP is already added by Google AMP cache but without this directive. Also this directive could not be used in CSP specified via meta tag.

1. What do you think about this security risk?
2. Is it possible to add frame-ancestors into CSP policy of AMP cache with values for Google and Bing domains?

[Gregable]

@oxdef Thanks for the details. It seems like the attack requires some form of credentials transfer via the CORS response to amp-list or similar components. This was not an angle I had considered.

I’m reviewing this with some security folks to better understand the attack surface. Since there is a security issue here, it’s considered P1 and will remain so unless we determine the risk is otherwise low.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs. Thank you for your contributions.