Clickjacking: UI Redressing Risks and Defenses

Overview

Clickjacking (UI redressing) tricks users into clicking hidden or overlaid interface elements inside a framed sensitive page. If a critical action can be framed, attackers can piggyback on a victim’s authenticated session UI.

What You Will Learn

• Sensitive actions to protect

• Controls to verify

• Remediation

Sensitive actions to protect

• Confirmations for transfers, deletions, consent grants, and MFA changes

• One-click enable/disable security settings

• Social actions: follows, likes, shares, permissions

Controls to verify

• X-Frame-Options behavior

• CSP frame-ancestors policy

• Frame-busting scripts as legacy defense-in-depth only

• Whether APIs behind the UI also require CSRF-safe confirmation

Remediation

• Deny framing for sensitive origins by default

• Allow only explicit trusted parents when embedding is required

• Prefer server-enforced framing policy over JavaScript-only busting

Conclusion

Use this guide only on systems you are authorized to test. At SapiensHack, we focus on clear methodology, solid notes, and findings that help teams fix real risk—not noisy scanner output.

If you want related reading, browse the matching category in the sidebar and continue the series from there.