Azure / Azure/api-management-developer-portal

Developer Portal - Clickjacking vulnerability

Open
#2,275 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
545
Forks
360
PR merge metrics
No merged PRs in 30d

Description

## Bug description

For Developer Portal, after Pen test by Security team they identified a vulnerability "The web application is vulnerable to clickjacking". With the usage of Burp Clickbandit feature the team managed to overlay an iframe or a "clickable"
area on top of the website. PFB for reference.

image

As we could not override the Iframe tag, kindly support on the right approach to fix the bug.

## Expected behaviour

Below are the remediations recommended by Security team:

There are three main mechanisms that can be used to defend against these attacks:

• Preventing the browser from loading the page in frame using the X-Frame-Options or Content Security
Policy (frame-ancestors) HTTP headers.
• Preventing session cookies from being included when the page is loaded in a frame using the Same Site
cookie attribute.
• Implementing JavaScript code in the page to attempt to prevent it being loaded in a frame (known as a
"frame-buster").

Note that these mechanisms are all independent of each other, and where possible more than one of them should.
be implemented in order to provide defense in depth.

## Is your portal managed or self-hosted?

Self-hosted

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.