clickjacking attacks verhindern
Clickjacking embeds your site in ein invisible iframe und tricks Benutzer in clicking. Lernen X-Frame-Optionen und CSP frame-ancestors.
- 1
Clickjacking (UI redress) embeds the target site in a transparent iframe over a decoy page. The user thinks they are clicking the decoy but actually clicking the target (e.g., "Delete account" button). Prevention: (1) X-Frame-Options: DENY (or SAMEORIGIN) — legacy, supported by all browsers. (2) Content-Security-Policy: frame-ancestors 'none' (or 'self') — modern, more flexible. (3) Frame-busting JavaScript (unreliable, use headers instead).
- 2 HTML-Minifier →
Minifizieren the HTML response to verify that X-Frame-Options or CSP frame-ancestors headers are present. These headers must be set by the server, not in the HTML. Check your server configuration (nginx, Apache) or framework middleware to ensure they are set on every response.
- 3 Hash-Rechner →
For frame-busting scripts (legacy fallback), use a hash to verify the script integrity. Modern defense relies on headers (X-Frame-Options, CSP frame-ancestors) — frame-busting scripts can be bypassed and should only be used as a fallback for very old browsers. The primary defense must be HTTP headers.
Häufige Fragen
- X-Frame-Options vs CSP frame-ancestors?
- CSP frame-ancestors is the modern replacement — it supports multiple origins (frame-ancestors 'self' https://trusted.com), while X-Frame-Options only supports DENY or SAMEORIGIN. If both are present, CSP takes precedence. Use CSP frame-ancestors for new applications; include X-Frame-Options for legacy browser support.
- When do I need to allow framing?
- When your site is intentionally embedded: social media widgets, payment gateways (Stripe), OAuth popup flows, or your own subdomains. Use SAMEORIGIN or frame-ancestors 'self' for same-origin framing. For specific trusted origins, use CSP frame-ancestors with the allowed origins. Never allow framing from all origins.