Clickjacking

Clickjacking can be referred as an emerging threat on web. It is a malicious technique in which the Web user is tricked into clicking on something different from what the user perceives they are clicking, in turn reveals confidential information or taking control of their computer while clicking on web pages. It is an embedded code or a script that can execute without the user's knowledge, like clicking on a button that appears to perform another function.Clickjacking can cause severe damages, including compromising a user’s private webcam, email or other private data.The user views only the top level page but when they click, they actually trigger the functionality from another hidden layer. This causes some actions which the user never really intended.

The root cause of clickjacking is that an attacker application presents a sensitive UI element of a target application out of context to a user (such as hiding the UI by making it transparent), and hence the user is tricked to act out of context.

All modern browsers support the iframe HTML tag used to include content from another page in the current page. When the browser renders this tag, it fetches the page specified by the src attribute of the iframe tag and displays that page inside a region of the current page. For example:

<iframe src="http://www.microsoft.com/" height="300px" width="300px" />

Including this HTML tag on a web page will draw a 300×300 pixel frame displaying the home page of the Microsoft.com web site on that page. Users can interact with this frame just as if they had typed www.microsoft.com into the browser themselves; they can navigate hyperlinks, press buttons, submit forms, anything.

How to Prevent

In order to prevent this attack, we need to prevent others from framing our application. In ASP.NET application, we can simply add this to <system.webServer> in our Web.Config.

<System.Webserver>

<httpProtocol>

 <customHeaders>

        <add name="X-Frame-Options" value="DENY" />

      </customHeaders>

</httpProtocol>

</System.WebServer>

You can also add the below code to global.asax file

protected void Application_BeginRequest (object sender, EventArgs e)

{

HttpContext.Current.Response.AddHeader ("X-Frame-Options", "DENY");

}

Here we are adding X-FRAME-Options to response headers with value DENY.

There are 3 values possible to X-Frame-Options: 

i) DENY: do not allow any site to frame your application

ii) SAMEORIGIN: only allow same application site to frame

iii) ALLOW-FROM: only allow specific domain to frame your application