Potential clickjack vuln
See original GitHub issueBug / Vulnerability
This was reported through the DoD VDP. Basically someone could load our site in an iFrame and then inject JS into it.
Page(s) Affected
One mitigation would be to add the X-Frame-Options
header to DENY
(See the Code.mil channel in Slack if you want to see the original report)
Issue Analytics
- State:
- Created 5 years ago
- Comments:9 (7 by maintainers)
Top Results From Across the Web
Clickjacking
Clickjacking, also known as a “UI redress attack”, is when an attacker uses multiple transparent or opaque layers to trick a user into...
Read more >What is Clickjacking | Attack Example | X-Frame-Options ...
Clickjacking is an attack technique that tricks users with invisible or disguised webpage elements. Learn how it can harm your business and how...
Read more >Clickjacking (UI redressing) - Web Security Academy
Clickjacking attacks are possible whenever websites can be framed. Therefore, preventative techniques are based upon restricting the framing capability for ...
Read more >Clickjacking | Learn AppSec
Potential consequences of a clickjacking attack. Attackers may abuse clickjacking vulnerabilities to achieve many different goals:.
Read more >Protecting Your Users Against Clickjacking
Clickjacking won't affect your site directly, but it could potentially affect your users. ... Want to see this vulnerability in action? Take our...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
I didn’t know about that tag, thanks!
@arichiv ok I got it. Ok for this kind of static site why not you use CSP as a security measure to prevent clickjacking, It can be implemented in the header like this
<meta http-equiv="Content-Security-Policy" content="frame-ancestors 'self'">
Hope this solves the issue.