Insecure or unset HTTP headers - X-Frame Options - Java

Insecure or unset HTTP headers - X-Frame Options - Java

Need

Implementation of a more secure and effective protection mechanism against clickjacking

Context

  • Usage of Java for building cross-platform applications
  • Usage of HttpServletResponse for handling HTTP responses in Java Servlets

Description

Non compliant code

        import javax.servlet.http.HttpServletResponse;

public void setHeader(HttpServletResponse response) {
    response.addHeader("X-Frame-Options", "SAMEORIGIN");
}
        
        

In the above code snippet, the application is setting the HTTP header 'X-Frame-Options' to 'SAMEORIGIN'. This means that the application is allowing the browser to render the page in a , </code> or <code style="background-color: #f6f8fa; padding: 2px 4px; border-radius: 4px;"><object></code> only if the domain is the same as the one serving the page. This is a mechanism to protect against clickjacking attacks.<br><br>However, this method of protection is considered deprecated because it can be bypassed using several iframe layers. If an attacker is able to load the application within an iframe on a malicious website, they could trick the user into clicking on invisible buttons or links, leading to unintended actions being performed on the application.<br><br>Therefore, relying solely on the 'X-Frame-Options' header for clickjacking protection exposes the application to potential security vulnerabilities. It's recommended to use more modern security mechanisms, such as Content Security Policy (CSP), in addition to 'X-Frame-Options' to ensure robust protection against clickjacking attacks.</p> <h3>Steps</h3> <ul> <li>Replace the use of X-Frame-Options header with Content-Security-Policy header.</li> <li>Set the Content-Security-Policy header to include the 'frame-ancestors' directive with the 'self' value.</li> <li>Ensure that the Content-Security-Policy header is set on all server responses.</li> <li>Test the application to ensure that the clickjacking vulnerability is mitigated.</li> </ul> <h3>Compliant code</h3> <div style="box-sizing: border-box; background-color: #f6f8fa; padding: 16px; border-radius: 6px; overflow: auto; margin-top: 0px; margin-bottom: 16px;"> <pre style="box-sizing: border-box; margin: 0; padding: 0; background-color: inherit;"> <code style="box-sizing: border-box; background-color: inherit; border: none; font: inherit; float: left; min-width: 100%;" >import javax.servlet.http.HttpServletResponse; public void setHeader(HttpServletResponse response) { response.addHeader("Content-Security-Policy", "frame-ancestors 'self'"); } </code> </pre> </div> <p>The previous code was vulnerable to clickjacking attacks because it was using the deprecated <code style="background-color: #f6f8fa; padding: 2px 4px; border-radius: 4px;">X-Frame-Options</code> header as the only protection mechanism. This header can be bypassed using several iframe layers, making it an insecure method of protection.<br><br>The updated code replaces the <code style="background-color: #f6f8fa; padding: 2px 4px; border-radius: 4px;">X-Frame-Options</code> header with the <code style="background-color: #f6f8fa; padding: 2px 4px; border-radius: 4px;">Content-Security-Policy</code> header. This header is more secure and cannot be bypassed in the same way. The <code style="background-color: #f6f8fa; padding: 2px 4px; border-radius: 4px;">Content-Security-Policy</code> header is set to include the <code style="background-color: #f6f8fa; padding: 2px 4px; border-radius: 4px;">frame-ancestors</code> directive with the <code style="background-color: #f6f8fa; padding: 2px 4px; border-radius: 4px;">'self'</code> value. This means that the page can only be embedded by a page of the same origin, effectively preventing clickjacking attacks.<br><br>It's important to ensure that the <code style="background-color: #f6f8fa; padding: 2px 4px; border-radius: 4px;">Content-Security-Policy</code> header is set on all server responses to provide consistent protection across the application.<br><br>After implementing these changes, it's recommended to test the application to ensure that the clickjacking vulnerability is effectively mitigated.</p> <h2>References</h2> <ul> <li><a href="criteria-vulnerabilities-152">152. Insecure or unset HTTP headers - X-Frame Options</a></li> </ul>