Clickjacking Protection for Java EE - Revision history

Jmanico: Redirected page to Clickjacking Defense Cheat Sheet

2016-03-24T20:48:00Z

Redirected page to Clickjacking Defense Cheat Sheet

Show changes

Imifos: flagged for deletion

2016-02-14T11:48:28Z

flagged for deletion

Imifos at 11:57, 20 January 2016

2016-01-20T11:57:04Z

Schlm3: /* Download */

2015-10-05T15:32:33Z

‎Download

Schlm3: /* Download */

2015-10-05T15:31:55Z

‎Download

Jeff Williams at 20:04, 25 January 2013

2013-01-25T20:04:53Z

Schnellmann: Updated statement about browser support of x-frame-options header

2010-09-23T06:54:47Z

Updated statement about browser support of x-frame-options header

Jeff Williams: moved ClickjackFilter for Java EE to Clickjacking Protection for Java EE

2009-10-26T03:42:51Z

moved ClickjackFilter for Java EE to Clickjacking Protection for Java EE

Jeff Williams at 03:10, 26 October 2009

2009-10-26T03:10:25Z

Jeff Williams at 19:34, 6 February 2009

2009-02-06T19:34:44Z

← Older revision		Revision as of 11:48, 14 February 2016
Line 1:		Line 1:
		+	{{taggedDocument
		+	\| type=delete
		+	\| comment=Page content is outdated and topic explained too superficially for 2015 security state. Library is outdated and gives a false feeling of security as the topic is more complex than the library handles. Moreover the page is not related to Java EE but to Java based web applications in general.
		+	}}
		+
	==Status==		==Status==

Line 158:		Line 163:

	You may want to check out the [http://evil.hackademix.net/frameopts/ demo] page that Giorgio Maone put together.		You may want to check out the [http://evil.hackademix.net/frameopts/ demo] page that Giorgio Maone put together.
−
−	~~[[Category:How To]]~~
−	~~[[Category:Java]]~~
−	~~[[Category:Countermeasure]]~~
−	~~[[Category: Control]]~~

@@ Line 160: / Line 160: @@
 [[Category:How To]]
-[[Category:OWASP Java Project]]
+[[Category:Java]]
 [[Category:Countermeasure]]
 [[Category: Control]]

@@ Line 41: / Line 41: @@
 '''Attention:''' The source listed below contains an update which is not part of the ClickjackFilter.zip. See [http://stackoverflow.com/questions/11371755/clickjacking-filter-to-add-x-frame-options-in-response].
-Use the source listed below rather then the one in the zip file.
+Use the source listed below rather than the one in the zip file.
 ==Setup==

← Older revision		Revision as of 15:31, 5 October 2015
Line 39:		Line 39:

	'''[https://www.owasp.org/images/1/15/ClickjackFilter.zip DOWNLOAD]'''		'''[https://www.owasp.org/images/1/15/ClickjackFilter.zip DOWNLOAD]'''
		+
		+	'''Attention:''' The source listed below contains an update which is not part of the ClickjackFilter.zip. See [http://stackoverflow.com/questions/11371755/clickjacking-filter-to-add-x-frame-options-in-response].
		+	Use the source listed below rather then the one in the zip file.

	==Setup==		==Setup==

@@ Line 122: / Line 122: @@
      public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
          HttpServletResponse res = (HttpServletResponse)response;
          chain.doFilter(request, response);
+     }

← Older revision		Revision as of 06:54, 23 September 2010
Line 19:		Line 19:
	not cause any change in the page-load experience. More to come soon!		not cause any change in the page-load experience. More to come soon!

−	However, there's an alternative approach that may be simpler to implement. Microsoft has now included a [http://blogs.msdn.com/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx defense] in IE8 that allows developers to specify that pages should not be framed. They use a new (nonstandard) X-FRAME-OPTIONS header to mark responses that shouldn't be framed. There are two options with X-FRAME-OPTIONS. The first is DENY, which prevents everyone from framing the content. The other option is SAMEORIGIN, which only allows the current site to frame the content. Currently this works in IE8 ~~RC1+~~, ~~but will not affect users of other browsers until they decide to implement this feature.~~ Firefox ~~users may want to look at the protection in NoScript~~.	+	However, there's an alternative approach that may be simpler to implement. Microsoft has now included a [http://blogs.msdn.com/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx defense] in IE8 that allows developers to specify that pages should not be framed. They use a new (nonstandard) X-FRAME-OPTIONS header to mark responses that shouldn't be framed. There are two options with X-FRAME-OPTIONS. The first is DENY, which prevents everyone from framing the content. The other option is SAMEORIGIN, which only allows the current site to frame the content. Currently this works in IE8, Firefox, Safari, Opera and Chrome.

← Older revision	Revision as of 03:42, 26 October 2009
(No difference)

@@ Line 3: / Line 3: @@
 Released Feb 6, 2009
-==Overview==
+==How to Stop ClickJacking==
-This article shows how to prevent the IE8+ users of your JavaEE application from getting clickjacked.
+This article shows how to prevent the IE8+ users of your Java EE application from getting clickjacked.
 [[Clickjacking]] is an attack that tricks users by showing them an innocuous page but including the real controls from sensitive pages. These controls are disguised through the use of background frames that mask off everything except the control, so that the user can't tell that they are actually clicking on a sensitive function in some other website.
-How can web applications protect their users from this attack?  The typical defense to clickjacking is to prevent your pages from being framed. The typical approach to this is to include a "frame-breaker" script in every page that ensures that the content is not framed. Here's an example of such a script.
+How can web applications protect their users from this attack?  The typical defense to clickjacking is to prevent your pages from being framed. The typical approach to this is to include a "framebreaker" script in every page that ensures that the content is not framed. Here's an example of such a script.
 <pre>
 &lt;script>if (top != self) top.location=location</script>
 </pre>
 However, there's an alternative approach that may be simpler to implement. Microsoft has now included a [http://blogs.msdn.com/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx defense] in IE8 that allows developers to specify that pages should not be framed. They use a new (nonstandard) X-FRAME-OPTIONS header to mark responses that shouldn't be framed. There are two options with X-FRAME-OPTIONS. The first is DENY, which prevents everyone from framing the content. The other option is SAMEORIGIN, which only allows the current site to frame the content. Currently this works in IE8 RC1+, but will not affect users of other browsers until they decide to implement this feature. Firefox users may want to look at the protection in NoScript.

← Older revision		Revision as of 19:34, 6 February 2009
Line 150:		Line 150:
	There's a very simple test case in the WebContent directory of the zip file. It has one page with the text "unframeable content" and another page that opens the first page in a frame. When you set the filter to DENY in web.xml, the page shows an error message that the content cannot be viewed in a frame. When you set it to SAMEORIGIN, the content is allowed.		There's a very simple test case in the WebContent directory of the zip file. It has one page with the text "unframeable content" and another page that opens the first page in a frame. When you set the filter to DENY in web.xml, the page shows an error message that the content cannot be viewed in a frame. When you set it to SAMEORIGIN, the content is allowed.

		+	You may want to check out the [http://evil.hackademix.net/frameopts/ demo] page that Giorgio Maone put together.

	[[Category:How To]]		[[Category:How To]]