Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Potential clickjack vuln

See original GitHub issue

Bug / Vulnerability

This was reported through the DoD VDP. Basically someone could load our site in an iFrame and then inject JS into it.

Page(s) Affected

https://code.mil/

One mitigation would be to add the X-Frame-Options header to DENY

(See the Code.mil channel in Slack if you want to see the original report)

Issue Analytics

State:
Created 5 years ago
Comments:9 (7 by maintainers)

Top GitHub Comments

1reaction

arichivcommented, Jun 1, 2018

I didn’t know about that tag, thanks!

0reactions

BalajiJBcscommented, Jun 1, 2018

@arichiv ok I got it. Ok for this kind of static site why not you use CSP as a security measure to prevent clickjacking, It can be implemented in the header like this

<meta http-equiv="Content-Security-Policy" content="frame-ancestors 'self'">

Hope this solves the issue.

Top Results From Across the Web

Clickjacking

Clickjacking, also known as a “UI redress attack”, is when an attacker uses multiple transparent or opaque layers to trick a user into...

What is Clickjacking | Attack Example | X-Frame-Options ...

Clickjacking is an attack technique that tricks users with invisible or disguised webpage elements. Learn how it can harm your business and how...

Clickjacking (UI redressing) - Web Security Academy

Clickjacking attacks are possible whenever websites can be framed. Therefore, preventative techniques are based upon restricting the framing capability for ...

Clickjacking | Learn AppSec

Potential consequences of a clickjacking attack. Attackers may abuse clickjacking vulnerabilities to achieve many different goals:.

Protecting Your Users Against Clickjacking

Clickjacking won't affect your site directly, but it could potentially affect your users. ... Want to see this vulnerability in action? Take our...