Clickjacking in Aspnet with Cockroachdb

Clickjacking is a client-side attack that tricks a user into interacting with a hidden UI element inside an iframe, often by loading a vulnerable page inside a transparent or opaque frame. In an ASP.NET application that uses CockroachDB as the backend store, the vulnerability arises not from CockroachDB itself, but from missing UI-level defenses that allow an attacker’s page to embed or overlay content on your pages. If your ASP.NET pages render sensitive actions (such as changing account settings or performing a transaction) without anti-clickjacking protections, an attacker can load your domain in an iframe and position controls over trusted UI elements.

When CockroachDB is used as the data store, the risk is contextual: if your application pulls sensitive data to render forms or status pages, an embedded page can partially or fully cover those CockroachDB-driven views. For example, an attacker’s malicious page might embed /profile or /transfer endpoints that display account balances from CockroachDB inside hidden iframes. Without proper X-Frame-Options or Content-Security-Policy (frame-ancestors), browsers may render those pages inside the attacker’s frame, enabling clickjacking. The presence of CockroachDB does not introduce a new attack vector, but if your ASP.NET pages dynamically render CockroachDB data into interactive controls, those controls become the clickjacking targets.

ASP.NET provides several mechanisms to mitigate this. For pages served via Controllers or Razor Pages, you can set response headers that prevent framing. You can also use frame-busting JavaScript as a defense-in-depth measure, though headers are the primary and reliable approach. Importantly, scanning your API surface with a tool like middleBrick can identify whether endpoints that render CockroachDB-driven content expose missing security headers, helping you prioritize remediation.

Remediation focuses on ensuring that no page that reads from or writes to CockroachDB can be framed. Below are concrete ASP.NET examples that set security headers and include a minimal CockroachDB interaction using Npgsql.

1. Configure anti-clickjacking headers in ASP.NET Core

In Program.cs, add a policy that sets X-Frame-Options and Content-Security-Policy for all responses. This ensures pages rendering CockroachDB data cannot be embedded by external sites.

// Program.cs
builder.Services.AddControllersWithViews();

// Add security headers policy
builder.Services.AddHttpStrictTransportSecurity(options =>
{
    options.IncludeSubDomains = true;
    options.Preload = true;
});

var app = builder.Build();

// Enforce anti-clickjacking headers for all responses
app.Use(async (context, next) =>
{
    context.Response.Headers.Add("X-Frame-Options", "DENY");
    context.Response.Headers.Add("Content-Security-Policy", "frame-ancestors 'none'");
    await next();
});

app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();
app.MapControllers();
app.Run();

2. Per-endpoint override (if needed)

If a specific page must be framed by trusted partners, set a more restrictive policy for that endpoint only. The following example disables framing for sensitive CockroachDB-driven pages unless explicitly allowed.

// Controllers/AccountController.cs
[HttpGet("/profile")]
public IActionResult Profile()
{
    // Fetch data from CockroachDB via a service
    var model = _accountService.GetProfileData(User.Identity.Name);
    return View(model);
}

// Optionally, set headers conditionally if you cannot use the global policy
public IActionResult ProfileWithCustomHeader()
{
    Response.Headers.Add("X-Frame-Options", "SAMEORIGIN");
    Response.Headers.Add("Content-Security-Policy", "frame-ancestors 'self' https://trusted.partner.com");
    var model = _accountService.GetProfileData(User.Identity.Name);
    return View(model);
}

3. CockroachDB connection and query example (defense-in-context)

Ensure that queries fetching data used in UI elements are safe and that no open redirect or injection issues exist that could aid clickjacking. Use parameterized queries with Npgsql to avoid injection that might lead to unintended page behavior.

// Services/AccountService.cs
using Npgsql;
public class AccountService
{
    private readonly string _connectionString;
    public AccountService(IConfiguration configuration)
    {
        _connectionString = configuration.GetConnectionString("CockroachDb");
    }

    public ProfileModel GetProfileData(string userEmail)
    {
        const string sql = "SELECT id, email, display_name, balance FROM users WHERE email = @email LIMIT 1";
        using var conn = new NpgsqlConnection(_connectionString);
        conn.Open();
        using var cmd = new NpgsqlCommand(sql, conn);
        cmd.Parameters.AddWithValue("email", userEmail);
        using var reader = cmd.ExecuteReader();
        if (reader.Read())
        {
            return new ProfileModel
            {
                Id = reader.GetInt32(0),
                Email = reader.GetString(1),
                DisplayName = reader.GetString(2),
                Balance = reader.GetDecimal(3)
            };
        }
        throw new InvalidOperationException("User not found.");
    }
}

public class ProfileModel
{
    public int Id { get; set; }
    public string Email { get; set; }
    public string DisplayName { get; set; }
    public decimal Balance { get; set; }
}

4. Verify headers and test framing behavior

After deploying the above, verify that responses include X-Frame-Options: DENY and Content-Security-Policy: frame-ancestors 'none'. You can test locally by attempting to frame the page from a simple HTML file and confirming that browsers block the content. For ongoing monitoring, integrate middleBrick’s scans to ensure headers remain present across deployments and that no new endpoints inadvertently allow framing of CockroachDB-driven content.