Clickjacking, a deceptive technique often referred to as UI redressing, remains a persistent concern for web application security. By embedding a legitimate website into an iframe and overlaying it with malicious, invisible layers, attackers can trick users into performing unintended actions. Recent research shared by SANS ISC provides a comprehensive look at how the top 1 million most popular domains—based on the Tranco list—have evolved their use of framing protection security headers over the past three years.
Understanding the 2024 Security Header Landscape
Security analysts and SOC teams frequently audit HTTP response headers to evaluate a site’s defensive posture. The primary headers used to combat framing-based attacks are X-Frame-Options (XFO) and the Content Security Policy (CSP) frame-ancestors directive. While both serve similar purposes, their adoption rates and implementation methods vary significantly. According to the analysis, there has been a steady increase in the use of these headers as organizations move toward more Zero Trust inspired web configurations.
X-Frame-Options vs CSP frame-ancestors Comparison
When performing an X-Frame-Options vs CSP frame-ancestors comparison, it is clear that X-Frame-Options remains the most common choice due to its long history and simplicity. Introduced in 2009, XFO supports three primary directives: DENY, SAMEORIGIN, and the now-deprecated ALLOW-FROM. However, XFO lacks the granularity required for modern, complex web ecosystems.
In contrast, the CSP frame-ancestors directive, part of the CSP Level 2 specification, offers much more flexibility. It allows a developer to list multiple authorized parent domains, providing a more robust defense than the single-origin limitation of XFO. Despite these benefits, the transition to CSP has been slower than expected. The data indicates that while many sites have adopted XFO, a smaller percentage have successfully implemented the more advanced CSP directive to protect against framing-based XSS delivery or data exfiltration.
Detecting Clickjacking Vulnerabilities in Web Applications
For a SIEM or security researcher, detecting clickjacking vulnerabilities in web applications often starts with identifying missing or misconfigured headers. If a site lacks both XFO and CSP frame-ancestors, it is fundamentally susceptible to being framed by any third-party origin. This vulnerability is categorized under MITRE ATT&CK as a form of user interaction-based exploitation.
The 2024 analysis highlights that even when headers are present, they are sometimes set to SAMEORIGIN by default without a deep understanding of the application’s legitimate framing needs. This can lead to breaking functionality in legitimate portal or dashboard environments while still leaving gaps if the origin itself is compromised through Lateral Movement.
Technical Implementation and Best Practices
To ensure a resilient defense, organizations should transition from legacy headers to modern standards. Many practitioners are currently researching how to implement CSP frame-ancestors for web security as a replacement for XFO. The recommended approach is to provide both headers for maximum compatibility across older and modern browsers.
- Prioritize CSP: Use
Content-Security-Policy: frame-ancestors 'self' https://trusted.partner.com;. This is more secure and supports multiple origins. - Maintain XFO for Legacy Support: Continue to use
X-Frame-Options: SAMEORIGINfor older browsers that do not support CSP Level 2. - Audit and Monitor: Use automated tools to scan all public-facing endpoints. A CVE is rarely assigned for a missing header alone, but its absence is a frequent finding in high-severity penetration tests.
By staying informed on these adoption trends, security professionals can better prioritize their remediation efforts and ensure their web assets are not the next target for UI redressing campaigns.
Related: Ghost CMS CVE-2022-41654: Over 700 Websites Compromised, Bot Mitigation with CAPTCHAs: Understanding Cloudflare Turnstile