# What is Clickjacking?

> Clickjacking, also called user-interface redressing, is an attack in which a malicious interface conceals, overlays, or repositions content from another application so a user’s click or tap activates a control different from the one the user perceives.

- Canonical URL: https://yellowcube.eu/glossary/clickjacking/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

The hidden target may use the user’s existing session and permissions. Clickjacking exploits the relationship between visual presentation, framing, and user intent; it does not require script execution in the target application.

Many web cases rely on embedding a sensitive page in a transparent or disguised frame. Applications should declare which origins, if any, may frame each response and design high-consequence actions so a single misdirected interaction is insufficient.

### Key points

- **Framing policy:** Deliver a Content Security Policy (CSP) response header with the `frame-ancestors` directive to deny framing or allow only required origins, and apply an `X-Frame-Options` response header where legacy compatibility is needed.
- **Sensitive interactions:** Require clear context, current authorization, deliberate confirmation or reauthentication for high-impact changes, and avoid controls whose meaning is hidden or changes unexpectedly.
- **Deployment checks:** Apply policy to every sensitive response, test intended and unintended embedding across supported browsers, account for nested frames and trusted partners, and monitor configuration regressions.
- **Important limitation:** Framing controls address frame-based attacks, not every form of deceptive interface. Broad allowlists, compromised permitted origins, browser differences, or actions that do not require authentication can leave exploitable paths.

### Related terms

[Cross-site request forgery (CSRF)](<https://yellowcube.eu/glossary/cross-site-request-forgery/>) · [Cross-site scripting (XSS)](<https://yellowcube.eu/glossary/cross-site-scripting/>) · [Browser security](<https://yellowcube.eu/glossary/browser-security/>) · [Web application security](<https://yellowcube.eu/glossary/web-application-security/>) · [Authentication](<https://yellowcube.eu/glossary/authentication/>)

### Sources

[OWASP Clickjacking Defense Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html) · [MITRE CWE-1021: Improper Restriction of Rendered UI Layers or Frames](https://cwe.mitre.org/data/definitions/1021.html) · [RFC 7034 (Informational): X-Frame-Options](https://www.rfc-editor.org/info/rfc7034/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.