Prevent clickjacking attacks
Clickjacking embeds 你的 site 在不可见 iframe 和 tricks users 为 clicking. Learn X-帧-Options 和 CSP 帧-ancestors.
- 1
Clickjacking (UI redress) embeds 目标 site 在 transparent iframe 遍历 decoy page. 用户 thinks 它们是 clicking decoy 但 actually clicking 目标 (e.g., "Delete account" button). Prevention: (1) X-帧-Options: DENY (或 SAMEORIGIN) — 遗留, supported 通过所有 browsers. (2) Content-Security-Policy: 帧-ancestors 'none' (或 'self') — 现代, 更多灵活. (3) 帧-busting JavaScript (unreliable, use headers instead).
- 2 HTML 压缩器 →
压缩 the HTML response to verify that X-Frame-Options or CSP frame-ancestors headers are present. These headers must be set by the server, not in the HTML. Check your server configuration (nginx, Apache) or framework middleware to ensure they are set on every response.
- 3 哈希计算器 →
为帧-busting scripts (遗留 fallback), use hash 到验证脚本完整性. 现代防御 relies 开 headers (X-帧-Options, CSP 帧-ancestors) — 帧-busting scripts 能够是 bypassed 和应该仅 是 used as fallback 为 very 旧 browsers. 主防御必须是 HTTP headers.
常见问题
- X-帧-Options vs CSP 帧-ancestors?
- CSP 帧-ancestors 是现代 replacement — 它 supports 多个 origins (帧-ancestors 'self' https://trusted.com), while X-帧-Options 仅 supports DENY 或 SAMEORIGIN. 如果两者是 存在, CSP takes precedence. Use CSP 帧-ancestors 为新 applications; 包含 X-帧-Options 为遗留 browser 支持.
- 当 I need 到允许 framing?
- 当你的 site 是 intentionally embedded: social media widgets, payment gateways (Stripe), OAuth popup flows, 或你的 own subdomains. Use SAMEORIGIN 或帧-ancestors 'self' 为相同-源 framing. 为特定 trusted origins, use CSP 帧-ancestors 具有允许 origins. 从不允许 framing 从所有 origins.