Pill #2: Prevent Clickjacking Attack

Hello and welcome back to Pills Dev - your bite-sized podcast for mastering software engineering fundamentals. I'm your host - Bartosz from Dev Academy - sharing quick tips on security, quality, and system design. To get more hot juicy tips visit pills dot dev.

Today, let's talk about a common web security threat called clickjacking and how to prevent it. Imagine this scenario: you have built an amazing website with features that make users happy and they feel safe using it. Then one day, you discover your system is vulnerable to clickjacking. What does this mean? Well, here's the situation:

A user visits a malicious website with a tempting button, like "You won one hundred dollars." This website embeds your website in an invisible iframe. When the user clicks the button, they unknowingly click on your website, performing actions on your site as if they were logged in. Scary, right?

Here's how clickjacking works: The malicious site positions your site in such a way that when the user clicks, the action happens on your site instead. This could result in liking a post, sending a message, or even transferring money.

But don't worry. There's an easy way to protect your site from this kind of attack. You need to send proper HTTP headers while serving your website. The first option is using the X-Frame-Options header. You can set its value to DENY, which prevents any website from embedding your site, or to SAMEORIGIN, which allows only your domain to embed it.

Another option is to use the Content Security Policy with the frame-ancestors directive. This allows you to specify which origins can embed your site or to deny embedding entirely.

In summary, preventing clickjacking is straightforward. Just use the correct HTTP headers, such as X-Frame-Options or Content Security Policy, to ensure your website cannot be embedded in an iframe by an untrusted source.

Thanks for tuning in and learning with me today. If you enjoyed this episode, consider subscribing so you won't miss tomorrow's exciting content!