Clickjacking in Actix with Basic Auth

Clickjacking is a client-side UI redress attack where an attacker tricks a user into interacting with a hidden or disguised element inside an invisible or embedded frame. In Actix applications that use HTTP Basic Authentication, the combination of frame embedding and credential transmission in headers can expose authentication flows to clickjacking, even when the application itself does not directly leak credentials.

When an Actix service protected by Basic Auth is embedded inside an iframe on a malicious site, the browser sends the Authorization header automatically with the request if the user is already authenticated to the domain. An attacker can overlay invisible UI elements (e.g., a transparent button or link) on top of the embedded content to capture user interactions intended for the attacker-controlled page. Because the browser includes the Basic Auth credentials with the request to the Actix endpoint, the authenticated action (such as changing email or modifying permissions) may be performed on behalf of the victim without their knowledge.

While HTTP Basic Auth transmits credentials on each request, it does not inherently protect against clickjacking. The browser’s same-origin policy prevents reading the response from an embedded cross-origin iframe, but it does not prevent the request from being made. If the Actix application does not enforce frame-ancestor restrictions or X-Frame-Options, an attacker can embed the protected endpoint in an iframe and drive interactions via CSS and JavaScript. The risk is especially pronounced in dashboards or administrative interfaces where users remain authenticated for long sessions, as an embedded malicious page may issue state-changing requests silently.

middleBrick’s unauthenticated black-box scans include checks for insecure framing policies as part of the Property Authorization and Input Validation test suite. These checks flag missing X-Frame-Options or Content-Security-Policy frame-ancestors directives that would otherwise permit embedding. Because the scanner does not require credentials, it can identify whether an endpoint is vulnerable to being embedded, which is a prerequisite for clickjacking against Basic Auth protected flows.

Remediation centers on preventing the endpoint from being embedded in frames and ensuring that user interactions cannot be hijacked. The most direct mitigation in Actix is to set strong framing policies. Combine X-Frame-Options with a strict Content-Security-Policy frame-ancestors directive to cover modern browsers. For Basic Auth, also ensure that credentials are not unnecessarily exposed in logs or error messages, and prefer moving to token-based authentication where feasible.

Below are concrete Actix examples that implement these protections. The first example sets headers middleware to apply X-Frame-Options and Content-Security-Policy to all responses.

use actix_web::{web, App, HttpResponse, HttpServer, middleware::Logger};
use actix_web::dev::ServiceRequest;
use actix_web::error::ErrorForbidden;
use std::task::{Context, Poll};
use actix_web::body::BoxBody;
use actix_web::dev::ServiceResponse;
use actix_web::middleware::Next;

// Custom middleware to set security headers
struct SecurityHeaders;

impl actix_web::dev::Transform for SecurityHeaders
where
    S: actix_web::dev::Service, Error = actix_web::Error>,
    S::Future: 'static,
    B: 'static,
{
    type Response = ServiceResponse;
    type Error = actix_web::Error;
    type InitError = ();
    type Transform = SecurityHeadersMiddleware;
    type Future = std::future::Ready>;

    fn new_transform(&self, service: S) -> Self::Future {
        std::future::ready(Ok(SecurityHeadersMiddleware { service }))
    }
}

struct SecurityHeadersMiddleware {
    service: S,
}

impl actix_web::dev::Service for SecurityHeadersMiddleware
where
    S: actix_web::dev::Service, Error = actix_web::Error>,
    S::Future: 'static,
    B: 'static,
{
    type Response = ServiceResponse;
    type Error = actix_web::Error;
    type Future = std::future::Ready>;

    fn poll_ready(&mut self, cx: &mut Context<'_>) -> Poll> {
        self.service.poll_ready(cx)
    }

    fn call(&mut self, req: ServiceRequest) -> Self::Future {
        let (req, pl) = req.into_parts();
        let mut res = actix_web::HttpResponse::Ok();
        res.headers_mut().insert(
            "X-Frame-Options",
            "DENY".parse().unwrap(),
        );
        res.headers_mut().insert(
            "Content-Security-Policy",
            "frame-ancestors 'none'".parse().unwrap(),
        );
        let res = actix_web::HttpResponse::from_parts(res.into_parts(), pl);
        std::future::ready(Ok(res.map_into_boxed_body()))
    }
}

#[actix_web::main]
async fn main() -> std::io::Result<()> {
    HttpServer::new(|| {
        App::new()
            .wrap(Logger::default())
            .wrap(SecurityHeaders)
            .route("/admin/settings", web::get().to(|| async { HttpResponse::Ok().body("Settings") }))
    })
    .bind("127.0.0.1:8080")?
    .run()
    .await
}

use actix_web::{web, App, HttpResponse, HttpServer};

async fn settings() -> HttpResponse {
    HttpResponse::Ok().body("Secure settings page")
}

#[actix_web::main]
async fn main() -> std::io::Result<()> {
    HttpServer::new(|| {
        App::new()
            .service(
                web::scope("/api")
                    .wrap(|req, srv| {
                        let fut = srv.call(req);
                        async move {
                            let mut res = fut.await?;
                            res.headers_mut().insert("X-Frame-Options", "DENY".parse().unwrap());
                            res.headers_mut().insert("Content-Security-Policy", "frame-ancestors 'none'".parse().unwrap());
                            Ok(res)
                        }
                    })
                    .route("/settings", web::get().to(settings)),
            )
    })
    .bind("127.0.0.1:8080")?
    .run()
    .await
}