Clickjacking (UI redressing) is an attack that tricks users into clicking something different from what they see, usually by placing an invisible web page over a harmless-looking one.
How clickjacking works
The attacker builds a decoy page – a game, a video player or a “Claim your prize” button – and loads the target website in a transparent <iframe> on top of it. The victim believes they are clicking the decoy, but the click actually lands on a button of the hidden site, where they are already logged in thanks to their cookies. The weakness is catalogued as CWE-1021 (improper restriction of rendered UI layers).
The term was coined by Jeremiah Grossman and Robert Hansen in 2008, when they showed that a hidden Adobe Flash settings page could be used to switch on a victim’s webcam and microphone. Variants include:
- Likejacking – making users “like” or share social media content unknowingly.
- Cursorjacking – displaying a fake cursor offset from the real one.
- Multi-step attacks that guide the user through several clicks or drag-and-drop actions.
Why clickjacking matters
Like cross-site request forgery, clickjacking makes the victim perform actions with their own privileges: changing account settings, granting OAuth or browser permissions, transferring money or deleting data. Because the victim performs a real click, protections against forged requests such as CSRF tokens do not help.
How to prevent clickjacking
- Send the
Content-Security-Policy: frame-ancestorsdirective (CSP) to control who may embed your pages. - Use the older
X-Frame-Options: DENYorSAMEORIGINheader (RFC 7034) for legacy browsers. - Set session cookies with
SameSiteso that framed pages do not receive them. - Require re-confirmation for sensitive actions.
