This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit

Difference between revisions of "Clickjacking Defense Cheat Sheet"

Jump to: navigation, search
m (Point to the official site)
(48 intermediate revisions by 12 users not shown)
Line 1: Line 1:
= Clickjacking Defense Introduction =
<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div>
This cheat sheet is focused on providing developer guidance on Clickjack/UI Redress attack prevention. For more information on the risk of Clickjacking, please visit [ this page].
The Cheat Sheet Series project has been moved to [ GitHub]!
The most popular way to defend against clickjacking is to include some sort of "frame-breaking" functionality which prevents other web pages from framing the site you wish to defend. This cheat sheet will discuss two methods of implementing frame-braking; via X-FRAME-OPTIONS headers (if the browser or browsers in question support it) and via javascript "frame-breaking" code.
Please visit [ Clickjacking Defense Cheat Sheet] to see the latest version of the cheat sheet.
= Defending with X-FRAME-OPTIONS response headers =
The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a &lt;frame&gt; or &lt;iframe&gt;. Sites can use this to avoid clickjacking attacks, by ensuring that their content is not embedded into other sites.
=== X-FRAME-OPTION  Header Types  ===
There are three types of X-FRAME-OPTIONS headers.
* The first is X-FRAME-OPTIONS <b>DENY</b>, which prevents any domain from framing the content.
* The second option is X-FRAME-OPTIONS <b>SAMEORIGIN</b>, which only allows the current site to frame the content.
* The third, is the X-FRAME-OPTIONS <b>ALLOW-FROM</b> 'sitename' header, which permits the specified 'sitename' to frame this page. (e.g., ALLOW-FROM http&#58;// The ALLOW-FROM option is a relatively recent addition (circa 2012) and may not be supported by all browsers yet.
=== Browser Support ===
The following browsers support X-FRAME-OPTIONS headers.
<table border="1">
<tr> <th>Browser</th> <th>Lowest version</th></tr>
<tr> <td>Internet Explorer</td> <td>8.0</td></tr>
<tr> <td>Firefox (Gecko)</td> <td>3.6.9 (</td></tr>
<tr> <td>Opera</td> <td>10.50</td> </tr> <tr> <td>Safari</td> <td>4.0</td></tr>
<tr> <td>Chrome</td> <td></td> </tr>
Reference: []
=== Implementation ===
To implement this protection, you need to add the header to any page that you want to protect from being clickjacked. One way to do this is to add the header manually to every page. A possibly simpler way is to implement a filter that automatically adds the header to every page.
= Defending legacy browsers =
The following methodology will prevent a webpage from being framed even in legacy browsers.
In the document HEAD element, add the following:
First apply an ID to the style element itself:
&lt;style id=&quot;antiClickjack&quot;&gt;body{display:none !important;}&lt;/style&gt;
And then delete that style by its ID immediately after in the script:
&lt;script type=&quot;text/javascript&quot;&gt;
    if (self === top) {
        var antiClickjack = document.getElementById(&quot;antiClickjack&quot;);
    } else {
        top.location = self.location;
This way, everything can be in the document HEAD and you only need one method/taglib in your API.
Reference: []
= Other Cheatsheets =

Latest revision as of 07:58, 15 July 2019


The Cheat Sheet Series project has been moved to GitHub!

Please visit Clickjacking Defense Cheat Sheet to see the latest version of the cheat sheet.