Clickjacking Protection for Java EE

Status

Released Feb 6, 2009

Overview

Clickjacking is an attack that tricks users by showing them an innocuous page but including the real controls from sensitive pages. These controls are disguised through the use of background frames that mask off everything except the control, so that the user can't tell that they are actually clicking on a sensitive function in some other website.

Approach

The primary defense to clickjacking is to prevent your pages from being framed. The typical approach to this is to include a "frame-breaker" script in every page that ensures that the content is not framed.

Microsoft has included a defense in IE8 that allows developers to specify that pages should not be framed. They use the X-FRAME-OPTIONS header to mark responses that shouldn't be framed. The inclusion of this header will prevent content from being framed in IE8+, but will not affect users of other browsers until they decide to implement this feature.

http://blogs.msdn.com/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx

In this article, we'll implement a simple filter to add the X-FRAME-OPTIONS to some or all of a JavaEE application.

Download

The source code (one file) and the compiled class file are in a single zip file.

DOWNLOAD

Setup

The first step is to add the filter to our application. All we have to do is put the ClickjackFilter class on our application's classpath, probably by putting it in the classes folder in WEB-INF. The class file should be in a folder structure that matches the package (org -> owasp -> filters -> ClickjackFilter). You can extract the class file from the zip file.

Then we just have to add the following filter definition and mapping to our web.xml. You should paste this in right above your servlet definitions. You should set up the mapping so it applies to any page that shouldn't be framed. Using /* will apply it to everything.

<?xml version="1.0" encoding="UTF-8"?>
<web-app id="WebApp_ID" version="2.4"
	xmlns="http://java.sun.com/xml/ns/j2ee"
	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
	<display-name>OWASP ClickjackFilter</display-name>

	<filter>
		<filter-name>ClickjackFilter</filter-name>
		<filter-class>org.owasp.filters.ClickjackFilter</filter-class>
	</filter>

	<filter-mapping> 
		<filter-name>ClickjackFilter</filter-name>
		<url-pattern>/*</url-pattern>
	</filter-mapping>

</web-app>

Source Code

/**
 *  Software published by the Open Web Application Security Project (http://www.owasp.org)
 *  This software is in the public domain with no warranty.
 *
 * @author     Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>
 * @created    February 6, 2009
 */

package org.owasp.filters;
import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletResponse;

public class ClickjackFilter implements Filter 
{

	/**
	 * Add X-FRAME-OPTIONS response header to tell IE8 (and any other browsers who
	 * decide to implement) not to display this content in a frame. For details, please
	 * refer to http://blogs.msdn.com/sdl/archive/2009/02/05/clickjacking-defense-in-ie8.aspx.
	 */
	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException
	{
        HttpServletResponse res = (HttpServletResponse)response;
        chain.doFilter(request, response);
        res.addHeader("X-FRAME-OPTIONS", "DENY" );			
	}

	public void destroy() {
	}

	public void init(FilterConfig filterConfig) throws ServletException {
	}
	
}

Compile

There are not many dependencies here, just the standard Java EE environment. You can compile with:

 javac -classpath servlet-api.jar -d . *.java

Then just copy the 'org' folder that gets created to the WEB-INF/classes folder.