Download Protecting Users Against Clickjacking and more Study notes Java Programming in PDF only on Docsity!
COMSCI 234 Javascript Security An examination of cross-site request forgery (CSRF). A cross-site request forgery (CSRF) attack on a website may be disastrous. This course will teach you all you need to know about them and how to protect yourself against them on both the back end (using Node.js examples) and the front end. Any knowledgeable web developer should be conversant with the different browser security measures for avoiding various forms of attacks.
Archiverr University Course: About the Course:
attacks trick web users into performing an action they did not intend, typically by rendering an invisible page element on top of the action the user thinks they are performing.
Clickjacking
Clickjacking won’t affect your site directly, but it could potentially affect your users. And only you can protect them!
Risks
What could a determined hacker do with a clickjacking attack?
Our tricked the user into “Liking” an item on Facebook. Clickjacking has also been used in the past to:
example hack
Topic: Protecting Users Against Clickjacking
Harvest login credentials , by rendering a fake login box on top of the real one. , by rendering invisible elements over the Adobe Flash settings page.
Trick users into turning on their web-cam or microphone
Spread wormson social media sites like Twitter and MySpace. Promote online scams by tricking people into clicking on things they otherwise would not. Spread malware by diverting users to malicious download links.
Protection
Clickjacking attacks wrap a page the user trusts in an iframe, then renders invisible elements on top of the frame. To ensure that your site doesn’t get used in a clickjacking attack, you need to make sure it cannot be wrapped in an iframe by a malicious site. This can be done by giving the browser instructions directly via , or in older browser by using client-side JavaScript ( ).
HTTP headers frame-killing
X-Frame-Options The can be used to indicate whether or not a browser should be allowed to render a page in a , or tag. It was designed speci cally to help protect against clickjacking.
X-Frame-Options HTTP header
There are three permitted values for the header:
DENY The page cannot be displayed in a frame, regardless of the site
attempting to do so.
SAMEORIGIN The page can only be displayed in a frame on the same origin as the
page itself.
ALLOW-FROM
uri
The page can only be displayed in a frame on the speci ed origins.
Content Security Policy
Most sites don’t need to be embedded in iframes, so a frame-killing script is easy to implement. If embedding required in your application, consider adding an allowlist of domains, so you have control over where your content is embedded.
is
Frame-killing offers a large degree of protection against clickjacking, but it can be error- prone. Be sure to set appropriate HTTP headers as the rst recourse in protecting your site.
Code Samples
The code samples below illustrate how to implement frame-killing in JavaScript, and how to set the HTTP headers mentioned above in various languages and web frameworks.
Frame Killing
Python
Django
response = render_to_response("template.html", {}, context_instance=RequestContext(request)) response['X-Frame-Options'] = 'DENY' response['Content-Security-Policy'] = "frame-ancestors 'none'" return response
Ruby
Rails
response.headers['X-Frame-Options'] = 'DENY' response.headers['Content-Security-Policy'] = "frame-ancestors 'none'"
Java
public void doGet(HttpServletRequest request, HttpServletResponse response) { response.addHeader("X-Frame-Options", "DENY"); response.addHeader("Content-Security-Policy", "frame-ancestors 'none'"); }
C#
Response.AppendHeader("X-Frame-Options", "DENY"); Response.AppendHeader("Content-Security-Policy", "frame-ancestors 'none'");
Node
response.setHeader("X-Frame-Options", "DENY"); response.setHeader("Content-Security-Policy", "frame-ancestors 'none'");
