Nikhilesh Gurjar
Nikhilesh Gurjar

Reputation: 1

How to Prevent Clickjacking Attacks in React website?

Unable to resolve the clickjacking issue in react website. I have tested this in clickjacking.io.

  1. frame busting
 <script>    
    if (self !== top) {    
     top.location = self.location;   
  }   
 </script>
  1. Security Header
<meta http-equiv="X-Frame-Options" content="SAMEORIGIN" />
<meta
      http-equiv="Content-Security-Policy"
      content="frame-ancestors 'self' https://admin.nutrition.huskwellness.com"
/>
  1. helmet used on the server side
app.use(
  helmet.contentSecurityPolicy({
    directives: {
      defaultSrc: ["'self'"],
      styleSrc: ["'self'", "'unsafe-inline'"],
      scriptSrc: ["'self'", "'unsafe-inline'"],
    },
  })
);
app.use(helmet.frameguard({ action: "deny" }));
app.use(helmet.xssFilter());
app.use(helmet.noSniff());
app.use(helmet.referrerPolicy({ policy: "same-origin" }));
app.use(helmet.permittedCrossDomainPolicies())

Tried this methods but still the site can be framed in iframe.

Upvotes: 0

Views: 294

Answers (0)

Related Questions