Clickjacking

Tricking a user into clicking a hidden or disguised element riding on a legitimate page.

Specifications & Metrics

cwe

CWE-1021

impact

Medium

Core Principles & Analysis

• An invisible iframe lays the attacker's button over the one the victim means to press.
• Frame-busting scripts were the old defence; the X-Frame-Options and CSP frame-ancestors headers are the real one.
• Famously demonstrated against web banking buttons and social-media "Like" controls.