Clickjacking (UI redress attack) is a malicious technique that tricks users into clicking something different from what they perceive. Proper HTTP headers are crucial for protecting against these attacks.

Understanding Clickjacking Protection Headers

Primary Headers for Clickjacking Protection

1. X-Frame-Options: Legacy but widely supported
2. Content-Security-Policy (frame-ancestors): Modern standard
3. Clear-Site-Data: Additional cleanup protection

Spring Security Implementation

Example 1: Basic Spring Security Configuration

@Configuration @EnableWebSecurity public class SecurityConfig { @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http // Clickjacking protection .headers(headers -> headers .frameOptions(frameOptions -> frameOptions .deny() // or .sameOrigin() ) .contentSecurityPolicy(csp -> csp .policyDirectives("frame-ancestors 'none'") ) .xssProtection(xss -> xss .headerValue(XXssProtectionHeaderWriter.HeaderValue.ENABLED_MODE_BLOCK) ) ) .authorizeHttpRequests(authz -> authz .anyRequest().permitAll() ); return http.build(); } }

Example 2: Advanced Header Configuration

@Configuration @EnableWebSecurity public class AdvancedSecurityConfig { @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http .headers(headers -> headers // Frame options for clickjacking protection .frameOptions(frameOptions -> frameOptions .sameOrigin() // Allow same origin framing ) // Content Security Policy .contentSecurityPolicy(csp -> csp .policyDirectives("default-src 'self'; " + "script-src 'self' 'unsafe-inline' https://trusted.cdn.com; " + "style-src 'self' 'unsafe-inline'; " + "img-src 'self' data: https:; " + "frame-ancestors 'self' https://trusted.example.com; " + "form-action 'self'") ) // X-Content-Type-Options .contentTypeOptions(contentType -> {}) // Strict Transport Security .httpStrictTransportSecurity(hsts -> hsts .includeSubDomains(true) .preload(true) .maxAgeInSeconds(31536000) // 1 year ) // Referrer Policy .referrerPolicy(referrer -> referrer .policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN) ) // Permissions Policy .permissionsPolicy(permissions -> permissions .policy("camera=(), microphone=(), location=(), payment=()") ) ); return http.build(); } }

Manual Servlet Filter Implementation

Example 3: Custom Security Headers Filter

@Component public class SecurityHeadersFilter implements Filter { private static final String CSP_POLICY = "default-src 'self'; " + "script-src 'self' 'unsafe-inline' https://trusted.cdn.com; " + "style-src 'self' 'unsafe-inline'; " + "img-src 'self' data: https:; " + "font-src 'self'; " + "connect-src 'self'; " + "frame-ancestors 'none'; " + "form-action 'self'; " + "base-uri 'self';"; @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletResponse httpResponse = (HttpServletResponse) response; // Clickjacking protection headers httpResponse.setHeader("X-Frame-Options", "DENY"); httpResponse.setHeader("Content-Security-Policy", CSP_POLICY); // Additional security headers httpResponse.setHeader("X-Content-Type-Options", "nosniff"); httpResponse.setHeader("X-XSS-Protection", "1; mode=block"); httpResponse.setHeader("Referrer-Policy", "strict-origin-when-cross-origin"); httpResponse.setHeader("Permissions-Policy", "camera=(), microphone=(), location=(), payment=()"); // Cache control for sensitive pages if (isSensitivePage((HttpServletRequest) request)) { httpResponse.setHeader("Cache-Control", "no-store, no-cache, must-revalidate"); httpResponse.setHeader("Pragma", "no-cache"); httpResponse.setDateHeader("Expires", 0); } chain.doFilter(request, response); } private boolean isSensitivePage(HttpServletRequest request) { String path = request.getRequestURI(); return path.contains("/admin") || path.contains("/account") || path.contains("/payment"); } @Override public void init(FilterConfig filterConfig) throws ServletException { // Initialization if needed } @Override public void destroy() { // Cleanup if needed } }

Example 4: Dynamic CSP Header Filter

@Component public class DynamicCspFilter implements Filter { private final CspPolicyProvider cspPolicyProvider; public DynamicCspFilter(CspPolicyProvider cspPolicyProvider) { this.cspPolicyProvider = cspPolicyProvider; } @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletRequest httpRequest = (HttpServletRequest) request; HttpServletResponse httpResponse = (HttpServletResponse) response; // Generate dynamic CSP based on request String cspPolicy = cspPolicyProvider.generatePolicy(httpRequest); String nonce = generateNonce(); // Replace nonce placeholder in CSP cspPolicy = cspPolicy.replace("'nonce-{nonce}'", "'nonce-" + nonce + "'"); httpResponse.setHeader("Content-Security-Policy", cspPolicy); httpResponse.setHeader("X-Frame-Options", "DENY"); // Store nonce in request for use in templates httpRequest.setAttribute("cspNonce", nonce); chain.doFilter(request, response); } private String generateNonce() { byte[] nonceBytes = new byte[16]; new SecureRandom().nextBytes(nonceBytes); return Base64.getEncoder().encodeToString(nonceBytes); } } @Service class CspPolicyProvider { public String generatePolicy(HttpServletRequest request) { String path = request.getRequestURI(); // Different policies for different sections if (path.startsWith("/admin")) { return adminPolicy(); } else if (path.startsWith("/public")) { return publicPolicy(); } else if (path.startsWith("/api")) { return apiPolicy(); } else { return defaultPolicy(); } } private String defaultPolicy() { return "default-src 'self'; " + "script-src 'self' 'nonce-{nonce}'; " + "style-src 'self' 'unsafe-inline'; " + "img-src 'self' data: https:; " + "font-src 'self'; " + "connect-src 'self'; " + "frame-ancestors 'none'; " + "form-action 'self'; " + "base-uri 'self';"; } private String adminPolicy() { return "default-src 'self'; " + "script-src 'self' 'nonce-{nonce}'; " + "style-src 'self' 'unsafe-inline'; " + "img-src 'self' data:; " + "font-src 'self'; " + "connect-src 'self'; " + "frame-ancestors 'none'; " + "form-action 'self'; " + "base-uri 'self';"; } private String publicPolicy() { return "default-src 'self' https://cdn.example.com; " + "script-src 'self' https://cdn.example.com 'nonce-{nonce}'; " + "style-src 'self' https://cdn.example.com 'unsafe-inline'; " + "img-src 'self' data: https:; " + "font-src 'self' https://fonts.googleapis.com; " + "connect-src 'self'; " + "frame-ancestors 'self' https://embed.example.com; " + "form-action 'self'; " + "base-uri 'self';"; } private String apiPolicy() { return "default-src 'none'; " + "frame-ancestors 'none';"; } }

Spring Boot Configuration Properties

Example 5: Application Properties Configuration

# application.yml server: servlet: session: cookie: secure: true http-only: true same-site: strict spring: security: headers: content-security-policy: "default-src 'self'; frame-ancestors 'none';" frame-options: DENY content-type: true xss-protection: true hsts: include-subdomains: true preload: true max-age: 31536000 # Custom security properties app: security: csp: enabled: true report-only: false policy: "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'" allowed-frame-ancestors: - "https://trusted.example.com" - "https://embed.partner.com"

Controller-Level Configuration

Example 6: Fine-Grained Header Control

@RestController public class SecureController { @GetMapping("/public/content") public ResponseEntity<String> publicContent() { return ResponseEntity.ok() .header("X-Frame-Options", "SAMEORIGIN") .header("Content-Security-Policy", "frame-ancestors 'self'") .body("Public content that can be framed by same origin"); } @GetMapping("/sensitive/account") public ResponseEntity<String> sensitiveContent() { return ResponseEntity.ok() .header("X-Frame-Options", "DENY") .header("Content-Security-Policy", "frame-ancestors 'none'") .header("Cache-Control", "no-store, no-cache, must-revalidate") .body("Sensitive account information"); } @GetMapping("/embed/widget") public ResponseEntity<String> embeddableWidget() { String allowedOrigins = "https://trusted.example.com https://partner.com"; return ResponseEntity.ok() .header("X-Frame-Options", "ALLOW-FROM https://trusted.example.com") .header("Content-Security-Policy", "frame-ancestors " + allowedOrigins) .body("Embeddable widget"); } @GetMapping("/api/data") public ResponseEntity<Map<String, Object>> apiData() { Map<String, Object> data = Map.of("message", "API response"); return ResponseEntity.ok() .header("X-Frame-Options", "DENY") .header("Content-Security-Policy", "default-src 'none'; frame-ancestors 'none'") .body(data); } }

Example 7: Annotation-Based Header Configuration

@Target(ElementType.METHOD) @Retention(RetentionPolicy.RUNTIME) public @interface SecurityHeaders { FrameOptions frameOptions() default FrameOptions.DENY; String[] frameAncestors() default {}; boolean noCache() default false; enum FrameOptions { DENY, SAMEORIGIN, ALLOW_FROM } } @Aspect @Component public class SecurityHeadersAspect { @Around("@annotation(securityHeaders)") public Object applySecurityHeaders(ProceedingJoinPoint joinPoint, SecurityHeaders securityHeaders) throws Throwable { if (joinPoint.getTarget() instanceof HttpServletResponse) { HttpServletResponse response = (HttpServletResponse) joinPoint.getArgs()[1]; applyHeaders(response, securityHeaders); } return joinPoint.proceed(); } private void applyHeaders(HttpServletResponse response, SecurityHeaders securityHeaders) { // Apply frame options switch (securityHeaders.frameOptions()) { case DENY: response.setHeader("X-Frame-Options", "DENY"); break; case SAMEORIGIN: response.setHeader("X-Frame-Options", "SAMEORIGIN"); break; case ALLOW_FROM: if (securityHeaders.frameAncestors().length > 0) { response.setHeader("X-Frame-Options", "ALLOW-FROM " + securityHeaders.frameAncestors()[0]); } break; } // Apply CSP frame-ancestors if (securityHeaders.frameAncestors().length > 0) { String frameAncestors = String.join(" ", securityHeaders.frameAncestors()); response.setHeader("Content-Security-Policy", "frame-ancestors " + frameAncestors); } else { response.setHeader("Content-Security-Policy", "frame-ancestors 'none'"); } // Apply cache control if (securityHeaders.noCache()) { response.setHeader("Cache-Control", "no-store, no-cache, must-revalidate"); response.setHeader("Pragma", "no-cache"); } } } @RestController public class AnnotatedController { @GetMapping("/admin/dashboard") @SecurityHeaders(frameOptions = SecurityHeaders.FrameOptions.DENY, noCache = true) public String adminDashboard() { return "Admin dashboard"; } @GetMapping("/public/widget") @SecurityHeaders( frameOptions = SecurityHeaders.FrameOptions.ALLOW_FROM, frameAncestors = {"https://trusted.example.com", "https://partner.com"} ) public String publicWidget() { return "Public widget"; } }

Testing Clickjacking Protection

Example 8: Security Headers Testing

@SpringBootTest @AutoConfigureTestDatabase class ClickjackingProtectionTest { @Autowired private TestRestTemplate restTemplate; @Test void testClickjackingHeadersOnPublicEndpoint() { ResponseEntity<String> response = restTemplate.getForEntity("/public/content", String.class); HttpHeaders headers = response.getHeaders(); // Test X-Frame-Options assertThat(headers.getFirst("X-Frame-Options")).isEqualTo("DENY"); // Test CSP frame-ancestors assertThat(headers.getFirst("Content-Security-Policy")) .contains("frame-ancestors"); // Test additional security headers assertThat(headers.getFirst("X-Content-Type-Options")).isEqualTo("nosniff"); assertThat(headers.getFirst("X-XSS-Protection")).isNotNull(); } @Test void testSensitiveEndpointHasStrictHeaders() { ResponseEntity<String> response = restTemplate.getForEntity("/admin/dashboard", String.class); HttpHeaders headers = response.getHeaders(); // Test strict frame options assertThat(headers.getFirst("X-Frame-Options")).isEqualTo("DENY"); assertThat(headers.getFirst("Content-Security-Policy")) .contains("frame-ancestors 'none'"); // Test no-cache headers assertThat(headers.getFirst("Cache-Control")) .contains("no-store"); assertThat(headers.getFirst("Pragma")).isEqualTo("no-cache"); } @Test void testEmbeddableWidgetAllowsFraming() { ResponseEntity<String> response = restTemplate.getForEntity("/embed/widget", String.class); HttpHeaders headers = response.getHeaders(); // Test specific frame ancestors assertThat(headers.getFirst("Content-Security-Policy")) .contains("frame-ancestors https://trusted.example.com https://partner.com"); } } @Component class SecurityHeadersValidator { public ValidationResult validateHeaders(HttpHeaders headers) { ValidationResult result = new ValidationResult(); // Check required security headers checkFrameOptions(headers, result); checkCsp(headers, result); checkAdditionalHeaders(headers, result); return result; } private void checkFrameOptions(HttpHeaders headers, ValidationResult result) { String frameOptions = headers.getFirst("X-Frame-Options"); if (frameOptions == null) { result.addIssue("MISSING", "X-Frame-Options header is missing"); } else if (!frameOptions.equals("DENY") && !frameOptions.equals("SAMEORIGIN")) { result.addIssue("WEAK", "X-Frame-Options value might be weak: " + frameOptions); } } private void checkCsp(HttpHeaders headers, ValidationResult result) { String csp = headers.getFirst("Content-Security-Policy"); if (csp == null) { result.addIssue("MISSING", "Content-Security-Policy header is missing"); } else if (!csp.contains("frame-ancestors")) { result.addIssue("WEAK", "CSP missing frame-ancestors directive"); } else if (csp.contains("frame-ancestors *")) { result.addIssue("INSECURE", "CSP allows framing from any origin"); } } private void checkAdditionalHeaders(HttpHeaders headers, ValidationResult result) { if (headers.getFirst("X-Content-Type-Options") == null) { result.addIssue("MISSING", "X-Content-Type-Options header is missing"); } if (headers.getFirst("X-XSS-Protection") == null) { result.addIssue("MISSING", "X-XSS-Protection header is missing"); } } @Data public static class ValidationResult { private List<SecurityIssue> issues = new ArrayList<>(); private boolean passed = true; public void addIssue(String severity, String description) { issues.add(new SecurityIssue(severity, description)); passed = false; } } @Data public static class SecurityIssue { private final String severity; private final String description; } }

Best Practices and Recommendations

Security Configuration Best Practices

@Configuration public class SecurityBestPractices { @Bean public SecurityFilterChain bestPracticeFilterChain(HttpSecurity http) throws Exception { http .headers(headers -> headers // Always set both X-Frame-Options and CSP for maximum compatibility .frameOptions(frameOptions -> frameOptions.deny()) .contentSecurityPolicy(csp -> csp .policyDirectives(buildCspPolicy()) ) // Prevent MIME type sniffing .contentTypeOptions(ContentTypeOptionsConfig::disable) // Enable XSS protection .xssProtection(xss -> xss.block(true)) // HSTS for HTTPS sites .httpStrictTransportSecurity(hsts -> hsts .includeSubDomains(true) .preload(true) .maxAgeInSeconds(31536000) ) // Referrer policy .referrerPolicy(referrer -> referrer .policy(ReferrerPolicy.STRICT_ORIGIN_WHEN_CROSS_ORIGIN) ) // Feature policy (now Permissions Policy) .permissionsPolicy(permissions -> permissions .policy("camera=(), microphone=(), geolocation=(), payment=()") ) ) // Additional security configurations .csrf(csrf -> csrf .ignoringRequestMatchers("/api/public/**") ) .sessionManagement(session -> session .sessionFixation().migrateSession() .maximumSessions(1) .maxSessionsPreventsLogin(true) ); return http.build(); } private String buildCspPolicy() { return String.join("; ", "default-src 'self'", "script-src 'self' 'unsafe-inline' https://trusted.cdn.com", "style-src 'self' 'unsafe-inline'", "img-src 'self' data: https:", "font-src 'self' https://fonts.gstatic.com", "connect-src 'self'", "frame-ancestors 'none'", "form-action 'self'", "base-uri 'self'", "object-src 'none'" ); } }

Header Implementation Matrix

Conclusion

Clickjacking protection is essential for web application security. Key recommendations:

1. Use Both Headers: Implement both X-Frame-Options and Content-Security-Policy for maximum compatibility
2. Default to DENY: Unless specifically required, prevent all framing
3. Be Specific with Allowances: When allowing framing, specify exact origins
4. Test Thoroughly: Regularly test headers with automated tools
5. Monitor Reports: Use CSP report-uri to detect potential issues

Remember that security headers are just one layer of defense. Always implement proper authentication, authorization, and input validation alongside header-based protections.