Clickjacking Cheat Sheet - Revision history

Jmanico: Replaced content with "Moved to [https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet]."

2012-11-25T22:05:38Z

Replaced content with "Moved to [https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet]."

Jmanico: /* Specifics */

2012-11-18T01:26:57Z

‎Specifics

Jmanico: /* Specifics */

2012-11-18T01:26:36Z

‎Specifics

Jmanico at 01:18, 18 November 2012

2012-11-18T01:18:47Z

Jmanico: clarification

2012-11-18T01:18:25Z

clarification

Jmanico: /* Clickjacking Defense Introduction */

2012-11-18T01:16:55Z

‎Clickjacking Defense Introduction

Jmanico: /* Introduction */

2012-11-18T01:16:32Z

‎Introduction

Jmanico at 01:16, 18 November 2012

2012-11-18T01:16:11Z

Jmanico: /* Defending with response headers */

2012-11-18T01:15:24Z

‎Defending with response headers

Jmanico: /* Specifics */

2012-11-18T01:14:41Z

‎Specifics

← Older revision		Revision as of 22:05, 25 November 2012
Line 1:		Line 1:
−	~~= DRAFT CHEAT SHEET - WORK IN PROGRESS =~~	+	Moved to [https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet].
−
−	~~= Clickjacking Defense Introduction =~~
−
−	This cheat sheet is focused on providing developer guidance on Clickjack/UI Redress attack prevention. For more information on the risk of Clickjacking, please visit [https://www.owasp.org/index.php/Clickjacking this page].
−
−	~~The most popular way~~ to defend against clickjacking is to include some sort of "frame-breaking" functionality which prevents other web pages from framing the site you wish to defend. This cheat sheet will discuss two methods of implementing frame-braking; via X-FRAME-OPTIONS headers (if the browser or browsers in question support it) and via javascript "frame-breaking" code.
−
−	~~= Defending with X-FRAME-OPTIONS response headers =~~
−
−	~~The X-FRAME-OPTIONS header is used to mark responses that should not be framed.~~
−
−	~~=== Specifics ===~~
−
−	~~There are three types of X-FRAME-OPTIONS headers.~~
−	* The first is X-FRAME-OPTIONS <b>DENY</b>, which prevents any domain from framing the content.
−	* The second option is X-FRAME-OPTIONS <b>SAMEORIGIN</b>, which only allows the current site to frame the content.
−	* The third, is the X-FRAME-OPTIONS <b>ALLOW-FROM</b> 'sitename' header, which permits the specified 'sitename' to frame this page. (e.g., ALLOW-FROM http://www.foo.com) The ALLOW-FROM option is a relatively recent addition (circa 2012) and may not be supported by all browsers yet.
−
−	~~=== Browser Support ===~~
−
−	* The following browsers support X-FRAME-OPTIONS headers. from [http://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx http://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx])
−	** IE8+
−	** Opera 10.50+
−	** Safari 4+
−	** Chrome 4.1.249.1042+
−	** Firefox 3.6.9 (or earlier with NoScript)
−
−	~~=== Implementation ===~~
−
−	To implement this protection, you need to add the header to any page that you want to protect from being clickjacked. One way to do this is to add the header manually to every page. A possibly simpler way is to implement a filter that automatically adds the header to every page.
−
−	~~= Defending legacy browsers =~~
−
−	~~The following methodology will prevent a webpage from being framed even in legacy browsers.~~
−
−	~~In the document HEAD element, add the following:~~
−
−	~~First apply an ID to the style element itself:~~
−
−	~~<style id="antiClickjack">body{display:none !important;}</style>~~
−
−	~~And then delete that style by its ID immediately after in the script:~~
−
−	~~<script type="text/javascript">~~
−	~~if (self === top) {~~
−	~~var antiClickjack = document.getElementById("antiClickjack");~~
−	~~antiClickjack.parentNode.removeChild(antiClickjack);~~
−	~~} else {~~
−	~~top.location = self.location;~~
−	}
−	~~</script>~~
−
−	~~This way, everything can be in the document HEAD and you only need one method/taglib in your API.~~
−
−	~~= References =~~
−
−	* Main OWASP [https://www.owasp.org/index.php/~~Clickjacking~~ https://www.owasp.org/index.php/~~Clickjacking~~] ~~page~~.
−	* OWASP has an [[ClickjackFilter for Java EE\|article and some code]] that provides all the details for implementing this in the Java EE environment.
−	* The SDL blog has posted an [http://blogs.msdn.com/sdl/archive/2009/02/05/clickjacking-defense-in-ie8.aspx article] covering how to implement this in a .NET environment.
−	* In 2009, Microsoft implemented a [http://blogs.msdn.com/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx header based defense] in IE8 that allows developers to specify that pages should not be framed.
−
−	~~{{Cheatsheet_Navigation}}~~
−
−	~~[[Category:Cheatsheets]]~~

@@ Line 16: / Line 16: @@
 * The first is X-FRAME-OPTIONS <b>DENY</b>, which prevents any domain from framing the content.
 * The second option is X-FRAME-OPTIONS <b>SAMEORIGIN</b>, which only allows the current site to frame the content.
-* The third, is the X-FRAME-OPTIONS <b>ALLOW-FROM</b> 'sitename' header, which permits the specified 'sitename' to frame this page. (e.g., ALLOW-FROM http:&#58;&#58;www.foo.com) The ALLOW-FROM option is a relatively recent addition (circa 2012) and may not be supported by all browsers yet.
+* The third, is the X-FRAME-OPTIONS <b>ALLOW-FROM</b> 'sitename' header, which permits the specified 'sitename' to frame this page. (e.g., ALLOW-FROM http&#58;//www.foo.com) The ALLOW-FROM option is a relatively recent addition (circa 2012) and may not be supported by all browsers yet.
 === Browser Support ===

@@ Line 16: / Line 16: @@
 * The first is X-FRAME-OPTIONS <b>DENY</b>, which prevents any domain from framing the content.
 * The second option is X-FRAME-OPTIONS <b>SAMEORIGIN</b>, which only allows the current site to frame the content.
-* The third, is the X-FRAME-OPTIONS <b>ALLOW-FROM</b> 'sitename' header, which permits the specified 'sitename' to frame this page. (e.g., ALLOW-FROM http://www.foo.com) The ALLOW-FROM option is a relatively recent addition (circa 2012) and may not be supported by all browsers yet.
+* The third, is the X-FRAME-OPTIONS <b>ALLOW-FROM</b> 'sitename' header, which permits the specified 'sitename' to frame this page. (e.g., ALLOW-FROM http:&#58;&#58;www.foo.com) The ALLOW-FROM option is a relatively recent addition (circa 2012) and may not be supported by all browsers yet.
 === Browser Support ===

@@ Line 15: / Line 15: @@
 There are three types of X-FRAME-OPTIONS headers.
 * The first is X-FRAME-OPTIONS <b>DENY</b>, which prevents any domain from framing the content.
-* The second option is X-FRAME-OPTIONS <b>SAMEORIGIN/b>, which only allows the current site to frame the content.
+* The second option is X-FRAME-OPTIONS <b>SAMEORIGIN</b>, which only allows the current site to frame the content.
-* The third, is the X-FRAME-OPTIONS <b>ALLOW-FROM/b> 'sitename' header, which permits the specified 'sitename' to frame this page. (e.g., ALLOW-FROM http://www.foo.com) The ALLOW-FROM option is a relatively recent addition (circa 2012) and may not be supported by all browsers yet.
+* The third, is the X-FRAME-OPTIONS <b>ALLOW-FROM</b> 'sitename' header, which permits the specified 'sitename' to frame this page. (e.g., ALLOW-FROM http://www.foo.com) The ALLOW-FROM option is a relatively recent addition (circa 2012) and may not be supported by all browsers yet.
 === Browser Support ===

@@ Line 13: / Line 13: @@
 === Specifics ===
-There are three options with X-FRAME-OPTIONS.
+There are three types of X-FRAME-OPTIONS headers.
-* The first is DENY, which prevents everyone from framing the content.
+* The first is X-FRAME-OPTIONS <b>DENY</b>, which prevents any domain from framing the content.
-* The second option is SAMEORIGIN, which only allows the current site to frame the content.
+* The second option is X-FRAME-OPTIONS <b>SAMEORIGIN/b>, which only allows the current site to frame the content.
-* The third, is the ALLOW-FROM 'sitename' header, which permits the specified 'sitename' to frame this page. (e.g., ALLOW-FROM http://www.foo.com) The ALLOW-FROM option is a relatively recent addition (circa 2012) and may not be supported by all browsers yet.
+* The third, is the X-FRAME-OPTIONS <b>ALLOW-FROM/b> 'sitename' header, which permits the specified 'sitename' to frame this page. (e.g., ALLOW-FROM http://www.foo.com) The ALLOW-FROM option is a relatively recent addition (circa 2012) and may not be supported by all browsers yet.
 === Browser Support ===

@@ Line 3: / Line 3: @@
 = Clickjacking Defense Introduction =
-This article is focused on providing developer guidance on Clickjack/UI Redress attack prevention. For more information on the risk of Clickjacking, please visit [https://www.owasp.org/index.php/Clickjacking this page].
+This cheat sheet is focused on providing developer guidance on Clickjack/UI Redress attack prevention. For more information on the risk of Clickjacking, please visit [https://www.owasp.org/index.php/Clickjacking this page].
 The most popular way to defend against clickjacking is to include some sort of "frame-breaking" functionality which prevents other web pages from framing the site you wish to defend. This cheat sheet will discuss two methods of implementing frame-braking; via X-FRAME-OPTIONS headers (if the browser or browsers in question support it) and via javascript "frame-breaking" code.

@@ Line 1: / Line 1: @@
 = DRAFT CHEAT SHEET - WORK IN PROGRESS =
-= Introduction =
+= Clickjacking Defense Introduction =
 This article is focused on providing developer guidance on Clickjack/UI Redress attack prevention. For more information on the risk of Clickjacking, please visit [https://www.owasp.org/index.php/Clickjacking this page].
 The most popular way to defend against clickjacking is to include some sort of "frame-breaking" functionality which prevents other web pages from framing the site you wish to defend. This cheat sheet will discuss two methods of implementing frame-braking; via X-FRAME-OPTIONS headers (if the browser or browsers in question support it) and via javascript "frame-breaking" code.
 = Defending with X-FRAME-OPTIONS response headers =

@@ Line 7: / Line 7: @@
 The most popular way to defend against clickjacking is to include some sort of "frame-breaking" functionality which prevents other web pages from framing the site you wish to defend. This cheat sheet will discuss two methods of implementing frame-braking; via X-FRAME-OPTIONS headers (if the browser or browsers in question support it) and via javascript "frame-breaking" code.
-==Defending with X-FRAME-OPTIONS response headers==
+= Defending with X-FRAME-OPTIONS response headers =
 The X-FRAME-OPTIONS header is used to mark responses that should not be framed.
-====Specifics====
+=== Specifics ===
 There are three options with X-FRAME-OPTIONS.
@@ Line 18: / Line 18: @@
 * The third, is the ALLOW-FROM 'sitename' header, which permits the specified 'sitename' to frame this page. (e.g., ALLOW-FROM http://www.foo.com) The ALLOW-FROM option is a relatively recent addition (circa 2012) and may not be supported by all browsers yet.
-====Browser Support====
+=== Browser Support ===
 * The following browsers support X-FRAME-OPTIONS headers. from [http://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx http://blogs.msdn.com/b/ieinternals/archive/2010/03/30/combating-clickjacking-with-x-frame-options.aspx])
@@ Line 27: / Line 27: @@
 ** Firefox 3.6.9 (or earlier with NoScript)
-====Implementation====
+=== Implementation ===
 To implement this protection, you need to add the header to any page that you want to protect from being clickjacked. One way to do this is to add the header manually to every page.  A possibly simpler way is to implement a filter that automatically adds the header to every page.
-==Defending legacy browsers ==
+= Defending legacy browsers =
 The following methodology will prevent a webpage from being framed even in legacy browsers.