Content security policy: allows clickjacking
Summary: PortSwigger Research describes a Content Security Policy finding where the policy allows clickjacking, noting that CSP is meant to mitigate cross-site scripting by disabling dangerous behaviors such as untrusted JavaScript execution. The guidance is to set the frame-ancestors directive to 'none' if the site should not be framed or 'self' if it should frame itself, and to use the X-Frame-Options header with DENY or SAMEORIGIN.
Why it matters: A CSP that leaves framing open lets an attacker overlay your pages and capture clicks from users who believe they are on your site, and the fix is a single directive most teams never set.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026