Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Potential clickjack vuln

See original GitHub issue

Bug / Vulnerability

This was reported through the DoD VDP. Basically someone could load our site in an iFrame and then inject JS into it.

Page(s) Affected

One mitigation would be to add the X-Frame-Options header to DENY

(See the channel in Slack if you want to see the original report)

Issue Analytics

  • State:closed
  • Created 5 years ago
  • Comments:9 (7 by maintainers)

github_iconTop GitHub Comments

arichivcommented, Jun 1, 2018

I didn’t know about that tag, thanks!

BalajiJBcscommented, Jun 1, 2018

@arichiv ok I got it. Ok for this kind of static site why not you use CSP as a security measure to prevent clickjacking, It can be implemented in the header like this

<meta http-equiv="Content-Security-Policy" content="frame-ancestors 'self'">

Hope this solves the issue.

Read more comments on GitHub >

github_iconTop Results From Across the Web

Clickjacking, also known as a “UI redress attack”, is when an attacker uses multiple transparent or opaque layers to trick a user into...
Read more >
What is Clickjacking | Attack Example | X-Frame-Options ...
Clickjacking is an attack technique that tricks users with invisible or disguised webpage elements. Learn how it can harm your business and how...
Read more >
Clickjacking (UI redressing) - Web Security Academy
Clickjacking attacks are possible whenever websites can be framed. Therefore, preventative techniques are based upon restricting the framing capability for ...
Read more >
Clickjacking | Learn AppSec
Potential consequences of a clickjacking attack. Attackers may abuse clickjacking vulnerabilities to achieve many different goals:.
Read more >
Protecting Your Users Against Clickjacking
Clickjacking won't affect your site directly, but it could potentially affect your users. ... Want to see this vulnerability in action? Take our...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Post

No results found

github_iconTop Related Hashnode Post

No results found