Your Settings Page Could Be Framed by Anyone and Your Users Clicked a Button They Could Not See

A customer swore
she never did it.

Her account
had added a new admin.

The log agreed with her
in one way
and disagreed in another.

The click was real.

It came from her browser,
her session,
her cursor
on the right button.

She had been playing a game.

Click the moving star
to win a voucher.

Your settings page
was in that game,
and she never saw it.

It is called clickjacking.

Two researchers named it in 2008,
and the trick has not changed.

The attacker's page
loads yours
inside an iframe.

Then makes it invisible,
opacity zero,
and lines up the button
that matters
under the thing you are told to click.

You aim at a star.

You hit approve.

Your code saw
a normal request
from a logged in user
who pressed a button.

Because that is what it was.

There may have been
one thing in the way.

Browsers now
hold back cookies
from pages framed by another site,
if the cookie does not say otherwise.

Yours said otherwise.

SameSite none,
set two years ago
so single sign on
and an embedded widget
would work.

So the framed page
arrived logged in.

The real fix
is not about cookies.

It is one line,
on every response,
that says who is allowed
to put your page in a frame.

Content Security Policy,
frame ancestors none.

Or frame ancestors self,
if your own app frames itself.

The older header,
X-Frame-Options deny,
still helps the oldest browsers.

Its allow from setting
is ignored by modern ones,
so do not lean on it.

Two traps.

frame ancestors
does nothing
inside a meta tag.

It has to be a real header.

And it has to be
on the pages that matter,
the confirm screen,
the delete dialog,
the page that adds a user,
not only the home page
where somebody first tested it.

Then check it yourself.

A local file,
two lines,
an iframe
pointing at your settings page.

Open it.

If your page appears,
anyone can do the same.

And for the actions
you cannot take back,
ask for something
a hidden click cannot give.

The password again.

A typed confirmation.

Your page
does not decide
where it is shown.

Unless you tell the browser.

– Serguey Asael Shinder