Clickjacking Prevention via Secret Message Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Clickjacking poses a significant threat as users are tricked into performing unintended actions on hidden webpages, with malicious practices such as malware download, data collection, and spam dissemination, as illegitimate webpages deceive users by layering over legitimate ones.
Innovation Solution
Incorporating clickjacking prevention code in embedded webpages that prevents content rendering unless a secret message from a known domain is received, verifying the legitimacy of the embedding webpage, thereby ensuring only legitimate webpages can render the embedded content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If embedded webpage content is always rendered, then user experience is maintained, but clickjacking attacks succeed
Solution Approach 1:
The system performs preliminary verification by checking for the presence of a secret value from the embedding domain before rendering the embedded webpage content. This advance check prevents malicious content from being displayed while allowing legitimate content to render normally, thus maintaining security without compromising user experience for valid use cases.
Solution Approach 2:
A secret value acts as an intermediary verification mechanism between the embedding webpage and the embedded webpage. The secret, specific to each embedding domain, serves as a trusted mediator that proves the legitimacy of the embedding context, enabling the system to distinguish between malicious and legitimate embedding attempts.
2Reliability
If secret verification is implemented, then clickjacking is prevented, but system complexity increases
Solution Approach 1:
The browser's native postMessage API is leveraged to implement the secret verification mechanism without requiring additional custom communication infrastructure. The embedding webpage can autonomously send the secret to the embedded webpage using standard web APIs, reducing the need for complex custom verification systems while maintaining security.
Data Source
AI summary
Systems and methods provide for clickjacking prevention code provided in an embedded webpage to prevent clickjacking when the embedded webpage is called by an embedding webpage determined to be illegitimate. When the embedded webpage is loaded on a user device, the clickjacking prevention code is executed and initially prevents content of the embedded webpage from being rendered. Additionally, the clickjacking prevention code sends a message containing a secret to a known domain that provides legitimate embedding webpages. When the embedding webpage sends a message to the embedded webpage, the message is checked to see if it contains the secret. If the message contains the secret, the embedding webpage is legitimate since it originated from the known domain, and the content of the embedded webpage is rendered. Alternatively, if the message does not contain the secret, the content of the webpage is not rendered.