Clickjacking
A page hides a real button under a harmless-looking one, tricking you into clicking an action you never meant to approve.
See it
What it is
Clickjacking puts a page or control inside a transparent or disguised frame, then lines it up under something the victim means to click. The victim sees a play button or harmless dialog, but the browser sends the click to a logged-in account setting, purchase button, or permission control underneath. It is also called UI redressing. Jeremiah Grossman and Robert Hansen named it in 2008 with a demo that framed the Adobe Flash Player settings panel and had the victim click their own webcam on; Facebook-era likejacking was the same trick under a fake video player.
Reach for clickjacking defenses anywhere a sensitive action can be performed in a browser session. The main control is the Content Security Policy directive frame-ancestors, which names who may embed the page. `frame-ancestors 'none'` blocks all framing, while `'self'` permits only the same origin. `X-Frame-Options: DENY` or `SAMEORIGIN` remains a useful fallback for older clients.
The trap is treating JavaScript frame-busting code as the defense. It can fail when scripts are blocked or when nested frames change the conditions it expects. Headers are enforced by the browser before the page becomes clickable. Also check every legitimate embed before shipping `'none'`, because dashboards, payment flows, and support widgets sometimes depend on framing.
Ask AI for it
Add clickjacking protection to every HTML response in this app. Send `Content-Security-Policy: frame-ancestors 'none'` and `X-Frame-Options: DENY` from the server, including error pages and authenticated routes. If this product has a real same-origin embed, change both controls to `'self'` and `SAMEORIGIN`; do not allow wildcard framing. Remove JavaScript frame-busting code as the primary control. Add a Playwright test that loads a protected route in an iframe from a different origin and asserts that the browser blocks it, then verify that any approved same-origin embed still works.