Clickjacking

What it means

Clickjacking tricks somebody into clicking a button in your application by hiding it invisibly under something on an attacker's page. The victim sees a game, a video or a cookie banner. They click where they were led to click, and the click lands on your page, loaded transparently on top.

Because the user really is logged in, whatever that button does gets done, with their session and their permissions.

Dragging, keyboard tricks and overlaid input boxes are variations on the same idea.

Why it matters

The damage depends on what one click can do in your product. Approving a payment. Changing a permission. Accepting an invitation. Granting an integration access to an account.

It is rarely the most serious item in a report, and usually the cheapest to fix. That pairing is why it stays on the list. The effort runs to minutes while the failure runs to whatever your most powerful single click does.

Security reviews find it too. A customer's questionnaire asks whether you send framing protection, and an open answer costs meeting time on top of the risk.

How it shows up

One response header prevents it, and a new subdomain forgets it. The check is whether your pages load inside a frame on somebody else's site. You have to answer that for every hostname you serve, not the main one only.

Marketing sites, status pages and old internal tools are the usual gaps.

Then test it on a page that does something. A framed marketing page is a missing header. A framed page with one confirm button is a demonstration, and a confirmation step on important actions blunts it.