This vulnerability occurs when a website does not have appropriate security controls to prevent unauthorized websites from embedding its pages inside frames. Attackers may exploit this weakness to trick users into clicking buttons or performing actions they did not intend.
In this article, I'll explain what clickjacking means, how it works, its potential risks, and how website owners can prevent it.
What Is Clickjacking?
Clickjacking, also known as a UI redressing attack, is a technique in which an attacker tricks a user into interacting with a website element different from the one the user believes they are clicking.
For example, an attacker might create a fake webpage displaying a button that says Claim Your Free Gift. Behind the visible page, the attacker could place an embedded frame containing a legitimate website. If the elements are positioned to overlap, the user may unknowingly click a sensitive button on the embedded website.
This attack relies on misleading the user rather than directly breaking into the website.
How Does Clickjacking Work?
A typical clickjacking attack involves the following steps:
- An attacker creates a deceptive webpage designed to encourage users to click a button or link.
- The attacker embeds a legitimate website inside an HTML <iframe>.
See this example. It shows how a webpage is embeded inside a frame.
- The embedded website is positioned or disguised so that the user cannot easily recognize what they are interacting with. This is the job of an expert.
- The user clicks the visible element, but the click is delivered to an element on the embedded website.
- If the user is authenticated and the action is permitted, the unintended action may succeed.
What Does "Missing Frame Protection" Mean?
Modern browsers allow websites to display other webpages inside frames or iframes. This functionality is useful for legitimate purposes, such as embedding videos, maps, and internal application pages.
However, websites should control which other websites are allowed to embed their pages.
When a security scanner reports Clickjacking (Missing Frame Protection), it generally means the website does not return the expected HTTP response headers that restrict framing.
These "two" important security mechanisms can help address this issue.
- X-Frame-Options
The X-Frame-Options HTTP response header, controls whether a browser can display a page inside a frame.
Common values include:
- DENY — prevents the page from being displayed in a frame.
- SAMEORIGIN — allows framing only by pages from the same origin.
For example: X-Frame-Options: SAMEORIGIN
- Content-Security-Policy (CSP)
The Content Security Policy header provides more flexible control over website resources and embedding permissions. Its frame-ancestors directive specifies which origins are permitted to embed a page.
For example,
Content-Security-Policy: frame-ancestors 'self';
This allows pages from the same origin to embed the protected page while blocking other origins.
If the page must not be embedded by any website, the directive can instead be configured as,
Content-Security-Policy: frame-ancestors 'none';
These values should be selected according to the website's legitimate functionality.
What Are the Risks of Clickjacking?
The impact of these type attack depends on the website, the user's permissions, and the actions available on the affected pages.
Potential risks include:
- Unauthorized actions: Users may unintentionally submit forms or change account settings.
- Account-related changes: An attacker may attempt to trick authenticated users into changing security or profile settings.
- Financial impact: If sensitive transaction actions can be triggered and other required protections are absent, users may face financial consequences
- Administrative misuse: Users with administrative privileges may be tricked into performing unintended operations.
- Loss of trust: Successful attacks can damage a website's reputation and user confidence.
Remember: Missing frame protection alone does not prove that these outcomes are possible. The actual risk must be evaluated against the affected pages and available actions.
How to Fix Clickjacking in ASP.NET Framework on IIS
For websites built with ASP.NET Framework and hosted on Microsoft IIS, frame protection can commonly be configured through the web.config file. Its very simple.
- Step 1: Open the web.config File
Locate the web.config file in your website's application directory. Back up the existing file before making any changes.
- Step 2: Configure Security Headers
Add the following entries inside the existing <system.webServer> section:
<system.webServer> <httpProtocol> <customHeaders> <add name="Content-Security-Policy" value="frame-ancestors 'self';" /> <add name="X-Frame-Options" value="SAMEORIGIN" /> </customHeaders> </httpProtocol> </system.webServer>If these sections already exist, merge the entries into the existing configuration instead of creating duplicate sections. Also check whether the headers are already configured at the IIS server or application level.
- Step 3: Test the Website
After applying the configuration, verify that the website continues to work correctly. Test login pages, forms, navigation, and any legitimate embedded content.
- Step 4: Verify the Response Headers
You can inspect the HTTP response headers using browser Developer Tools or a command such as,
curl.exe -I https://www.encodedna.com/
Confirm that the response includes the intended Content-Security-Policy and X-Frame-Options headers. Also test relevant HTML pages directly, because static HTML files may be served separately from ASP.NET application responses.
Best Practices for Preventing Clickjacking
In addition to configuring frame protection, website owners should follow these security practices.
- Use an appropriate CSP policy: Restrict framing to trusted origins or disable it completely when embedding is unnecessary.
- Keep security headers consistent: Check application, IIS, reverse proxy, and CDN configurations for duplicate or conflicting headers.
- Protect sensitive operations: Require appropriate authorization and use anti-CSRF protections where applicable. Frame protection and CSRF protection address different threats.
🛡️ Anti-CSRF (Cross-Site Request Forgery) protections are security measures that prevent an attacker from tricking a logged-in user's browser into performing unwanted actions on a website where the user is authenticated.
Here's an example:
A server renders a form containing a secret token:
<form action="/change-email" method="POST"> <input type="hidden" name="csrf_token" value="random-token"> <input type="email" name="email"> <button type="submit">Update email</button> </form>
- Test after deployment: Verify response headers and ensure legitimate website functionality is not broken.
- Perform regular security assessments: This is also very important. Recheck the website periodically and investigate newly reported vulnerabilities.
Conclusion
Clickjacking (Missing Frame Protection) is a website security finding that indicates a lack of expected controls over how pages can be embedded in other websites.
By configuring appropriate HTTP response headers such as Content-Security-Policy with frame-ancestors and X-Frame-Options, website owners can reduce the risk of attackers tricking users into unintended interactions.
For ASP.NET Framework websites hosted on IIS, these headers can often be configured centrally through web.config. After making the change, always verify the response headers and test the website to ensure that the protection works as intended.