clickjacking

Clickjacking is a web application security exploit where a malicious website embeds a legitimate website via an <iframe> tag and adds its own transparent buttons or form elements over top in order to induce the target to click or enter data (such as passwords) believing themselves to be on the legitimate website. Alternatively, an attacker might embed a transparent (but clickable, via opacity: 0) <iframe> containing, say, a Facebook Like button for their page over top a visible “Click here for a free iPhone” button, inducing a user to try and click the “Free iPhone” button but in actuality clicking the transparent Like button on top of it.

Mitigation

• The X-Frame-Options header gives websites control over whether and where they can be embedded.
• A website’s Content Security Policy can specify frame-ancestors directives for finer-grained control over where it may be embedded.