The hidden target may use the user’s existing session and permissions. Clickjacking exploits the relationship between visual presentation, framing, and user intent; it does not require script execution in the target application.
Many web cases rely on embedding a sensitive page in a transparent or disguised frame. Applications should declare which origins, if any, may frame each response and design high-consequence actions so a single misdirected interaction is insufficient.
Key points
Framing policyDeliver a Content Security Policy (CSP) response header with the frame-ancestors directive to deny framing or allow only required origins, and apply an X-Frame-Options response header where legacy compatibility is needed.
Sensitive interactionsRequire clear context, current authorization, deliberate confirmation or reauthentication for high-impact changes, and avoid controls whose meaning is hidden or changes unexpectedly.
Deployment checksApply policy to every sensitive response, test intended and unintended embedding across supported browsers, account for nested frames and trusted partners, and monitor configuration regressions.
Important limitationFraming controls address frame-based attacks, not every form of deceptive interface. Broad allowlists, compromised permitted origins, browser differences, or actions that do not require authentication can leave exploitable paths.