Extended Clickjacking Detection
Overview
Beyond basic iframe embedding, clickjacking variants include:
- Cursorjacking: Replacing the browser cursor to mislead click position
- Drag-and-drop jacking: Tricking users into dragging content
- Touchjacking: Exploiting touch events on mobile
- Framebusting bypass: JavaScript framebusting that can be bypassed via
sandbox="allow-scripts"
Remediation
- Use CSP
frame-ancestors 'none'— not bypassable by sandbox attribute - Do not rely on JavaScript-only framebusting