Benutzer:MovGP0/ASP.NET Core/Click-Jacking

MovGP0

Über mich

Hilfen

Artikel

Weblinks

Literatur

Zitate

Notizen

Programmierung

MSCert

Physik

Programmierung ASP.NET Common OWIN • Razor • WebForms • MVC • WebAPI Core Configuration • Data Protection API • Dependency Injection • Routing Attack Vectors HTTPS • HSTS • HPKP • CSP • CSRF • Anti-XSS • CORS • Open Redirection • Click-Jacking Libraries OpenID • Azure AD

Click-Jacking

• malicious site shows another site in an iFrame
• form of other site is prefilled and cropped, such that the user only sees the submit button
• can be prevented with HTTP-Headers:

  X-Frame-Options: DENY
  X-Frame-Options: SAMEORIGIN
  X-Frame-Options: ALLOW-FROM https://example.com
  

NuGet: NWebsec.AspNetCore.Middleware

Startup.cs

public void Configure(IApplicationBuilder app, ILoggerFactory loggerFactory)
{
    app.UseXfe(o => o.Deny());
}

|}