Framebusting Javascript, Clickjacking and SEO
Hijacking a user's web session using an iframe is known as clickjacking. A technique called called "frame busting" is the most common defense to break out of the surrounding "enemy" frame. We developed a variant of the code that the Stanford Web Security Group suggested in their paper Busting Frame Busting: A Study of Clickjacking Vulnerabilities at Popular Sites which examined common frame busting code and the ways it can be circumvented.
Most of the current javascript solutions use a conditional statement like
if (top != self
Followed by a counter-action like:
top.location = self.location
The solutions may work if the victim page is enclosed by a single frame but fails when the attacker encloses the victim page in two frames. Double framing is only one attack, other methods examined in the paper include onBeforeUnload events, 204 Flushing, Cross Site Scripting (XSS), Referrer Checking and Clobbering top.location.
So what to do? The paper suggests using the X-Frame-Options HTTP header and creating a Firefox Content Security Policy.
We have coded a javascript variant that we use on pages that require text input like log-in forms, registration forms, password request forms and contact forms and other pages not usually indexed by the search engines. A minor drawback of any javascript solution is that it must be present on all pages that you want to protect from framing attacks. Although we cannot guarantee security - the code may already be vulnerable to unknown attacks - we believe it is currently the correct approach to the problem.
<style type="text/css">
html { visibility:hidden; }
</style>
<script language="javascript" type="text/javascript">
if ( self == top ) {
document.documentElement.style.visibility='visible';
} else {
top.location = self.location;
}
</script>
The code is simple. On page load the CSS style hides the html. The page will attempt to bust out of the frame but will remain blank if JavaScript is disabled; if the code is blocked by double framing or by unload events; or if the the code is blocked by 204 Flushing, XSS, Referring Checking or Clobbering.
The use of the code on non-indexed pages to prevent framing is highly recommended however there is a caveat for indexed pages. Because the solution hides content with CSS there may be an unintended impact on Moz Ranking when considering Search Engine Optimization (SEO) for pages indexed by the search engines. We have asked for clarification and will update this post as soon as we hear back from our friends at Google.
