Missing clickjacking protection

Web sites that do not restrict framing using the X-Frame-Options HTTP header or the frame-ancestors Content Security Policy directive may be vulnerable to UI redress attacks ("clickjacking"). In these attacks, the vulnerable site is loaded in a frame on an attacker-controlled site which uses opaque or transparent layers to trick the user into unintentionally clicking a button or link on the vulnerable site.

Recommendation

Set the X-Frame-Options HTTP header to DENY, to instruct web browsers to block attempts to load the site in a frame. Alternatively, if framing is needed in certain circumstances, specify SAMEORIGIN to permit framing by the same origin. The frame-ancestors directive in an enforced Content-Security-Policy header provides a more flexible alternative. For example, use frame-ancestors 'none' to prevent all framing, or use its source list to specify which origins may embed the application.

For ASP.NET Framework applications, the header may be specified either in the Web.config file, using the <customHeaders> tag, or within the source code of the application using the HttpResponse.AddHeader method. In general, prefer specifying the header in the Web.config file to ensure it is added to all requests. If adding it to the source code, ensure that it is added unconditionally to all requests. For example, add the header in the Application_BeginRequest method in the global.asax file.

For ASP.NET Core applications, set the header on HttpResponse.Headers. This can be done using the header dictionary's indexer or its Append, Add, or TryAdd methods.

Example

The following example shows how to specify the X-Frame-Options header within the Web.config file for ASP.NET:

<?xml version="1.0" encoding="utf-8" ?>
<configuration>
  <system.web>
  </system.web>
  <system.webServer>
    <httpProtocol>
      <customHeaders>
        <add name="X-Frame-Options" value="SAMEORIGIN" />
      </customHeaders>
    </httpProtocol>
  </system.webServer>
</configuration>

This next example shows how to specify the X-Frame-Options header within the global.asax file for an ASP.NET application:

protected void Application_BeginRequest(object sender, EventArgs e)
{
    HttpContext.Current.Response.AddHeader("X-Frame-Options", "DENY");
}

The following ASP.NET Core example uses an enforced Content Security Policy to disallow framing:

void Configure(IApplicationBuilder app)
{
    app.Use(async (context, next) =>
    {
        context.Response.Headers["Content-Security-Policy"] = "frame-ancestors 'none'";
        await next();
    });
}

References

• OWASP: Clickjacking Defense Cheat Sheet.
• Mozilla: X-Frame-Options
• Mozilla: Content-Security-Policy: frame-ancestors
• Common Weakness Enumeration: CWE-451.
• Common Weakness Enumeration: CWE-829.