The Clickjacking attack and X-Frame-Options
Clickjacking
Clickjacking is a type
of “web framing” or “UI redressing” attack. What that simply means in practice
is that:
1. A user (victim) is
shown an innocuous, but enticing web page (think watch online video)
2. Another web page (that generally does something important – think add
friends on social network) is layered on top of the first page and set to be
transparent
3. When the user thinks they are clicking on the web page they see (video),
they are actually clicking on the higher layered (framed) page that is
transparent
There
are two main ways to prevent clickjacking:
Using
X-Frame-Options
Configuring
IIS
To configure IIS to
send the X-Frame-Options header, add this your site's Web.config file:
<system.webServer>
<httpProtocol>
...
Employing
defensive code or Frame Busting
It is
possible to block the navigation caused by top.location assignment, in the onbeforeunload event.
<system.webServer>
...
<httpProtocol>
<customHeaders>
<add name="X-Frame-Options" value="SAMEORIGIN" />
</customHeaders>
</httpProtocol>
...
</system.webServer>
top.location assignment, in the onbeforeunload event.
<script>
| ||
if(top != window) {
| ||
top.location = window.location
| ||
}
| ||
</script>
|
<script>
|
window.onbeforeunload = function() {
|
window.onbeforeunload = null
|
return "Maybe you want to leave the page, before you become rich?!?"
|
}
|
</script>
|
<iframe src="http://javascript.info/files/tutorial/window/changetop.html"style="height:80px"></iframe>
|
The most reliable method is to suspend showing the document until the top == window check
<head>
<style>
body { display : none;} </style>
</head>
<body>
<script>
if (self
== top) {
var theBody
= document.getElementsByTagName('body')[0]
theBody.style.display
= "block"
} else {
top.location
= self.location
}
</script>
</body>
In the example above, we use document.getElementsByTagName('body') instead of document.body, because this way of getting BODY it works in all browsers when the
document is not ready.
Summary:X-Frame-Options at pages which are not meant to run
into a frame. The older frame busting method is less effective, but useful for
older browsers, like IE7.
|
<head>
|
||
|
<style>
body { display : none;} </style>
|
||
|
</head>
|
||
|
<body>
|
||
|
| ||
<script>
|
||
|
if (self
== top) {
|
||
|
var theBody
= document.getElementsByTagName('body')[0]
|
||
|
theBody.style.display
= "block"
|
||
|
} else {
|
||
|
top.location
= self.location
|
||
|
}
|
||
|
</script>
|
||
|
</body>
|
document.getElementsByTagName('body') instead of document.body, because this way of getting BODY it works in all browsers when the
document is not ready.X-Frame-Options at pages which are not meant to run
into a frame. The older frame busting method is less effective, but useful for
older browsers, like IE7.
Comments
Post a Comment