What is ClickJacking?
Clickjacking is a malicious process of tricking a Internet user into clicking on something different from what the user wants to click. Thus it reveals confidential information or taking control of their computer while clicking on seemingly innocuous web pages.
Who has termed the techniq
ue?
The term “clickjacking” was coined by Jeremiah Grossman and Robert Hansen in 2008
Defending with X-Frame-Options Response Headers
The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a <frame> or <iframe>. Sites can use this to avoid Clickjacking attacks, by ensuring that their content is not embedded into other sites.
There are three settings for X-Frame-Options:
SAMEORIGIN: This setting will allow page to be displayed in frame on the same origin as the page itself.
DENY: This setting will prevent a page displaying in a frame or iframe.
ALLOW-FROM uri: This setting will allow page to be displayed only on the specified origin.
How to implement in shared web hosting?
If your website is hosted on shared web hosting then you won’t have permission to modify httpd.conf. However, you can implement this by adding following line in .htaccess file.
Header append X-FRAME-OPTIONS “SAMEORIGIN”