问题
I have been reading a lot regarding iframes and clickjacking, and was not able to find the information I am looking for. Can you help me out with below questions?
How does Iframe clickjacking spread? I have seen lot of articles which mentions editing of html code in the local machine and by the same they are able to hijack users click by adding an invisible button. But, this is a modified logic on a local machine of a user. I am interested in knowing is it possible to push this same code to the cloud and impact every user logging in or using that portal? If yes, how?
If I enable Iframe options on my website, it is a security risk because my page can be loaded as an Iframe in some one else's website and they can misuse it. And if there is any secured data, if end user is accidentally entering on that website, the data is hacked. This is a security concern so it is always recommended not to allow Iframe, is that correct? Are there any other security risk.
Please add if there are any other risks.
回答1:
Clickjacking does not spread.
It is literally as it is stated - jacking clicks - nothing more. However, the consequences of those clicks could be severe.
Imagine you visit a site, evil.example.org. In another tab you are also logged into your bank, bank.example.com.
evil.example.org also loads bank.example.com in an IFrame. However, it uses CSS to make this IFrame invisible. And it does not load the home page, it loads the money transfer page, passing some parameters:
<iframe src="https://bank.example.com/loggedIn/transferMoney?toAccount=Bob&amount=100000"></iframe>
Now, this page does not transfer the money immediately. It asks the user to click to confirm the transfer to Bob.
However, evil.example.org draws a button right underneath the Confirm Transfer button saying Free iPad click here.
Because the IFrame is invisible, the user just sees Free iPad click here. But when they click, the browser registers the click against Confirm Transfer.
Because you are logged into the bank site in another tab, Bob has just nicked your money.
Note that the X-Frame-Options header fixes this vulnerability on your site, assuming it is set to SAMEORIGIN or DENY. You are vulnerable until you add the header. There's a new directive in CSP called frame ancestors - however, only the latest browsers support it, so you're best off adding both headers at the moment. This will give you protection on Internet Explorer 8 and later, plus Chrome, Firefox, Opera and Safari.
Preventing framing can also help thwart over attacks such as Cross Site History Manipulation.
来源：https://stackoverflow.com/questions/32579677/how-does-clickjacking-spread-in-layman-terms