(Semi-OT) Clickjacking countermeasure

2016-09-22 Thread lists
I ran one of these website inspection services on my website and it was deemed to be subject to Clickjacking. This might be a false positive since I don't use frames, but the info on this link was enough to make the error go away. I chose "DENY" since I don't use frames.  https://geekflare.com/

Re: (Semi-OT) Clickjacking countermeasure

2016-09-22 Thread c0nw0nk
https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet Inside your tags. body{display:none !important;} if (self === top) { var antiClickjack = document.getElementById("antiClickjack"); antiClickjack.parentNode.removeChild(antiClickjack); } else { top.locat

Re: (Semi-OT) Clickjacking countermeasure

2016-09-22 Thread lists
rsday, September 22, 2016 1:34 PM To: nginx@nginx.org Reply To: nginx@nginx.org Subject: Re: (Semi-OT) Clickjacking countermeasure https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet Inside your tags. body{display:none !important;} if (self === top) { var antiClic

Re: (Semi-OT) Clickjacking countermeasure

2016-09-22 Thread c0nw0nk
If you read the OWASP page it will also mention about header stripping etc and proxies that will remove the X-Frames headers there is no real way to stop proxies framing your site but the X-Frame-Options combined with that JavaScript is a good way to start it will stop the majority. Also break the

Re: (Semi-OT) Clickjacking countermeasure

2016-09-22 Thread lists
: (Semi-OT) Clickjacking countermeasure If you read the OWASP page it will also mention about header stripping etc and proxies that will remove the X-Frames headers there is no real way to stop proxies framing your site but the X-Frame-Options combined with that JavaScript is a good way to start it