Clickjacking
Clickjacking overlays or embeds your page transparently inside an attacker page, so user clicks on visible decoys land on your buttons — transfers, deletes, permission grants.
Definition
Clickjacking is UI redressing: the attacker frames the target page invisibly and places decoy elements above it. Unsuspecting clicks pass through to the real page, authorizing actions the user never saw. Defenses are frame-busting via X-FrameOptions or CSP frame-ancestors, plus UI hardening that makes framed operation detectable or inoperable.
Context and scope
Targeted at authenticated sessions where one click changes state: banking transfers, account deletion, OAuth consent, camera or notification permission prompts.
Common misconceptions
- HTTPS prevents framing — transport security is orthogonal; the page can still be framed anywhere
- JavaScript frame-busting is the modern fix — it is bypassable via sandboxed iframes that strip scripts; header policy is the reliable control
- Only login pages need protection — any state-changing authenticated page is a viable victim
Anti-patterns
- Setting X-FrameOptions on the login page only and leaving the dashboard framable
- Relying on a frame-busting script while third-party embeds need framing — scope policy with frame-ancestors instead
- Designing confirmation dialogs without requiring additional input, so a single stolen click completes the action
Related concepts
Related examples
Authoritative source
What it is
The browser renders your page inside an iframe on the attacker site with zero opacity under decoy content. The user aims at the decoy, the click coordinates land on your button, and the session cookie rides along because it is the user browser making the request.
How it works
Header defense declares who may frame: DENY, SAMEORIGIN, or CSP frame-ancestors with an origin list. frame-ancestors supersedes X-FrameOptions where supported and expresses allowlists properly. Server-side banners and re-authentication on sensitive actions raise the cost of any single stolen click.
When to protect
Every authenticated state-changing page. Public marketing pages that legitimately embed — widgets, docs — scope policy to trusted embedders via frame-ancestors rather than leaving everything open.
Pitfalls
Sandboxed iframes execute frame-busting bypasses by removing scripts. Legacy header support differs across user agents; send both directives during transition. Clickjacking-resistant interaction design — type a confirmation word, hold to confirm — defends even where framing policy is mishandled.