5 ms·

This wasn't CSRF, but clickjacking, aka UI redressing. CSRF protection does nothing against it. There are some ways to attempt to defend against it but I don'

by coderrr 18y ago

This wasn't CSRF, but clickjacking, aka UI redressing. CSRF protection does nothing against it. There are some ways to attempt to defend against it but I don't think there is any 100% reliable way yet. http://code.google.com/p/browsersec/wiki/Part2#Arbitrary_page_mashups_(UI_redressing) http://code.google.com/p/browsersec/wiki/Part2#Arbitrary_pag...

CalmQuiet 18y ago
Thank you for clarification. It seems that Twitter thinks (http://blog.twitter.com/2009/02/clickjacking-blocked.html http://blog.twitter.com/2009/02/clickjacking-blocked.html) they are reliably defending against it. Someone will soon be trying to determine if theirs is "100% reliable" yet. EDIT: So what do you think of the sufficiency of the "fix" as explained at: http://dsandler.org/outgoing/dontclick.html http://dsandler.org/outgoing/dontclick.html ?
- coderrr 18y ago
  this might be a way around it in IE http://code.google.com/p/browsersec/wiki/Part3#Microsoft_Internet_Explorer_frame_restrictions http://code.google.com/p/browsersec/wiki/Part3#Microsoft_Int...
  - coderrr 18y ago
    and one way around this is http://keepitlocked.net/archive/2008/11/07/preventing-clickjacking-with-framebusting.aspx http://keepitlocked.net/archive/2008/11/07/preventing-clickj...
    - wesley 18y ago
      They've just fixed this it seems. Content is now hidden in iframes.
- coderrr 18y ago
  Here's another way around it: http://coderrr.wordpress.com/2009/02/13/preventing-frame-busting-and-click-jacking-ui-redressing/ http://coderrr.wordpress.com/2009/02/13/preventing-frame-bus...
tectonic 18y ago
Thanks for the link to Google's browsersec page, that's really useful. http://code.google.com/p/browsersec/wiki/Main http://code.google.com/p/browsersec/wiki/Main