Clickjacking in Chi with Api Keys

Clickjacking is a client-side attack that tricks a user into interacting with a hidden or disguised UI element, often by loading a target page inside an invisible iframe. When API keys are involved in a Chi application, the combination of clickjacking vectors and key-bearing requests can expose privileged credentials or enable unintended actions. Chi routes typically render pages that may embed third-party resources or include inline frames. If those frames load an endpoint that returns a key-sensitive response (for example, a key generation or key display endpoint) without proper frame-busting or Content Security Policy (CSP) controls, an attacker can overlay a transparent UI layer to capture keystrokes or simulate clicks on the key-related UI.

Consider a Chi endpoint that returns an API key as part of a JSON response for a configuration page. If this page is served without anti-clickjacking headers and is embeddable in an iframe, an attacker could craft a malicious page that loads this Chi route inside a small, hidden iframe. The attacker then overlays interactive elements (such as a button styled to look harmless) positioned precisely over UI controls that reveal or rotate keys. A user authenticated to the Chi app might click what appears to be a benign element, inadvertently triggering a key rotation or disclosure. Because the request includes valid session cookies and the response contains sensitive keys, the attack can leak secrets without the user’s awareness.

Chi applications that integrate middleware for logging or telemetry can inadvertently amplify risks if those middlewares log full request/response cycles containing keys. An attacker who manages to induce a logged key disclosure via clickjacking gains visibility into values that should remain confidential. Even when keys are stored server-side and only referenced by identifier, UI flows that fetch keys for display or editing can be targeted. The attack does not require code execution on the server; it exploits the UI presentation layer and the trust placed in authenticated requests carrying API keys. Therefore, defending against clickjacking in Chi with API keys requires both technical controls (frame-ancestors policy, key handling in UI) and architectural considerations (how and when keys are surfaced to client-side code).

Remediation focuses on preventing embedding of sensitive pages and ensuring keys are never exposed to clickjacking-prone contexts. Use HTTP response headers to restrict framing and enforce strict CSP. In Chi, you can set headers in your middleware or route handlers. Below is a minimal Chi application that demonstrates secure headers and safe key handling.

// File: app.clj
(require '[ring.middleware.anti-forgery :refer [wrap-anti-forgery]]
         '[ring.util.response :refer [response]]
         '[compojure.core :refer [defroutes GET]]
         '[compojure.route :as route])

(defn secure-response [body]
  (-> (response body)
      (assoc-in [:headers "X-Frame-Options"] "DENY")
      (assoc-in [:headers "Content-Security-Policy"] "frame-ancestors 'none';")
      (assoc-in [:headers "X-Content-Type-Options"] "nosniff")))

(defroutes app-routes
  (GET "/api/keys" []
       (secure-response {:api-key "REDACTED_FROM_RESPONSE"}))
  (route/not-found "Not Found"))

(def app
  (-> app-routes
      wrap-anti-forgery))

The X-Frame-Options: DENY header prevents the page from being rendered in any frame, while Content-Security-Policy: frame-ancestors 'none' provides modern browsers with the same guarantee. Note that returning actual API keys in responses—even with secure headers—is risky. In practice, keys should be stored server-side, and the Chi endpoint should avoid echoing them to the client. Instead, return metadata or references that do not expose secrets. If keys must be shown for administrative purposes, ensure the route is accessible only via POST, requires re-authentication, and is served with the above headers.

For JavaScript-driven UIs, enforce strict CSP frame-src directives and avoid client-side libraries that dynamically embed iframes from untrusted origins. Rotate keys regularly and bind them to specific scopes and IP restrictions where supported. Combine these measures with runtime scanning that flags key exposure in responses; middleBrick can detect such misconfigurations in your OpenAPI specs and runtime behavior, helping you maintain a strong security posture around API keys in Chi.