This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit

CRV2 ClientSideCodeJackingFraming

Revision as of 15:15, 3 August 2014 by Larry Conklin (talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

In order to help prevent clickjacking or UI redress attacks one of the following headers should be in all HTTP response headers.

X-Frame-Options HTTP Response Header

// to prevent all framing of this content response.addHeader( "X-FRAME-OPTIONS", "DENY" );

// to allow framing of this content only by this site response.addHeader( "X-FRAME-OPTIONS", "SAMEORIGIN" );

// to allow framing from a specific domain response.addHeader( "X-FRAME-OPTIONS", "ALLOW-FROM X" );

Older browsers dont usderstand the above headers. In order to help prevent regress attacks we may see the following code on the client side files.

   Legacy Browser Clickjacking Defense
   <style id="antiCJ">body{display:none !important;}</style> 
   <script type="text/javascript"> 
   if (self === top) 
   { var antiClickjack = document.getElementByID("antiCJ"); 
   else { top.location = self.location; } 

To avoid click jacking or Cross Site Request Forgery of the website, look for implementation of X-Frame-Options .Keep in mind that this code might not work on legacy browsers. The website does a compatibility test on the browser’s x-frame-options support.