Avoid clickjacking attack

[Darth Florus]

Hi Pals:

Anyone know how to avoid clickjacking attack and XSS attack with UniGUI?

[Darth Florus]

This is the xss attack, but luckily is fixed on the last version.

[Darth Florus]

Hi Pals:

About ClickJacking Attack.

The solution is to atttach a flag X-Frame-Options or Content-Security-Policy(frame-ancestors) into the HTTP response of the server.

Anyone know how to attach this response to the HTTP Response on UniGUI?

Thanks and

Best Regards

[Mehmet Emin]

Are you running on IIS?

If yes you can add it like this:

https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options

[Mehmet Emin]

Or if you are running stand alone or service than this code:

procedure TUniServerModule.UniGUIServerModuleHTTPCommand(
  ARequestInfo: TIdHTTPRequestInfo; AResponseInfo: TIdHTTPResponseInfo;
  var Handled: Boolean);
begin
  AResponseInfo.CustomHeaders.AddValue('X-Frame-Options', 'DENY');
end;
 

[Darth Florus]

Thank Your Very Much!

I will implement this right now!