Clickjacking Defense with X-Frame-Options & CSP frame-ancestors

Prevent UI redressing and hidden iframe clickjacking attacks across legacy and modern browsers using dual defense headers.

1. Attack Signature & Impact Analysis

Medium (Unauthorized User Clicks)

Malicious sites render your authenticated admin or checkout page inside a transparent 0-opacity iframe, tricking logged-in users into clicking sensitive buttons.

2. Production Hardening Configuration (`/etc/nginx/conf.d/clickjacking-defense.conf`)

Deploy this validated configuration to your production server or reverse proxy:

# Dual Defense: X-Frame-Options (Legacy) + CSP frame-ancestors (Modern)
server {
    # Legacy browsers (IE / Safari 9-)
    add_header X-Frame-Options "DENY" always;

    # Modern standard browsers
    add_header Content-Security-Policy "frame-ancestors 'none';" always;
}

3. Live Simulation & Rule Verification Command

Execute these commands to verify that traffic is actively mitigated without service downtime:

# Verify response headers
curl -I https://yourdomain.com | grep -E -i "(x-frame-options|frame-ancestors)"
# Check iframe embedding status using online tester at https://clickjacker.io

4. Common Misconfigurations & Troubleshooting Gotchas

⚠️ Production Caution: If your SaaS needs to be embedded inside authorized partner portals (e.g. Shopify Admin), change `DENY` to `SAMEORIGIN` and specify `frame-ancestors 'self' https://partner.com;`.

5. Best Paired With (Complementary Defense Recipes)

Security engineers implementing this rule frequently deploy these complementary baselines: