Web Page Origin Authentication for Clickjacking Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web browsers and applications are vulnerable to clickjacking attacks, where users are tricked into interacting with elements they perceive as different, allowing attackers to conduct unauthorized actions or extract sensitive information without consent.
Innovation Solution
Implementing web page origin authentication that inhibits content rendering until the embedding web page proves its identity through a PostMessage API, comparing the origin to trusted or untrusted domains, and using CSS to control display properties, ensuring only trusted content is rendered.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If web page content is rendered without verification, then user experience and page load speed are improved, but the system becomes vulnerable to clickjacking attacks
Solution Approach 1:
The patent applies preliminary action by checking the origin of the embedding web page before rendering the content. The system verifies the origin using PostMessage API and compares it against trusted origins in advance, only then proceeding to render the content. This prevents clickjacking attacks while maintaining fast rendering for trusted sources.
2Reliability
If origin verification is performed for all embedded content, then security is improved, but device complexity and processing overhead increase
Solution Approach 1:
The patent applies local quality by making the verification process selective rather than universal. The system performs origin verification only for embedded content that may be susceptible to clickjacking, while allowing direct navigation and trusted sources to render without verification. This reduces overall complexity while maintaining security where needed.
3Reliability
If content rendering is inhibited until verification, then security is improved, but response time and user interaction are delayed
Solution Approach 1:
The verification process is performed preliminarily during the page load sequence, before the user would notice any delay. The system checks the origin and determines trustworthiness in the background, then renders the content immediately once verification is complete or if the source is already in the trusted list, minimizing perceived delay.
Data Source
AI summary
Methods, systems, and computer-readable storage media for preventing a clickjacking attack on a web page. Implementations include inhibiting rendering of content of the web page, receiving a message from an embedding web page, the embedding web page having called the web page, the message including metadata, and determining whether the embedding web page is trusted based on the metadata, wherein rendering of content of the web page remains inhibited if the embedding web page is untrusted, and rendering of content of the web page is executed if the embedding web page is trusted.