Clickjacking in Chi with Basic Auth

Clickjacking is a client-side attack that tricks a user into interacting with a hidden or disguised UI element, often by nesting the target application in an <iframe> and overlaying transparent controls. When Basic Authentication is involved, the risk profile changes because credentials are transmitted in an easily recoverable form.

Chi is a lightweight HTTP client for .NET. In Chi, developers typically configure a HttpClient with a HttpClientHandler and set credentials using the Credentials property. If the application embeds third‑party endpoints in iframes or otherwise reflects untrusted URLs, and those endpoints require Basic Auth, the following chain can occur:

1. An authenticated session exists (for example, a user logged into a dashboard that uses Basic Auth to call an internal admin API).
2. The application renders content that includes an iframe pointing to the Basic‑Auth‑protected Chi endpoint, or uses Chi to fetch a resource and then reflects the response in a UI component.
3. Because the credentials are often cached by the handler or reused across requests, a malicious page can overlay clickable regions on top of the embedded content. The user may unknowingly trigger actions or leak information via GET requests that were intended to be safe but are actually authenticated.

Crucially, Basic Auth sends credentials in an easily decoded Base64 string (not encryption), so if any part of the flow leaks headers or responses, credentials are exposed. While Chi itself does not introduce the framing issue, its typical usage patterns—such as setting default credentials on a shared handler and making requests to URLs that may be reflected—can inadvertently create a surface where clickjacking leads to unauthorized authenticated actions or information disclosure.

Even unauthenticated GET requests can be dangerous when nested in iframes because they may trigger state changes on the server (e.g., via unsafe HTTP methods or non‑idempotent logic). When combined with other API security findings reported by middleBrick—such as missing frame-busting headers or overly permissive CORS—clickjacking vectors become easier to chain with information leakage.

Remediation focuses on preventing credentials from being automatically sent to embedded contexts and ensuring that requests are not unintentionally triggered by user interaction with overlays. Do not rely on obscurity; treat Basic Auth credentials as easily recoverable.

1. Do not embed Basic Auth–protected endpoints in iframes

The most effective mitigation is to avoid embedding any endpoint that carries authentication (including Basic Auth) inside an iframe. If you must display data, proxy the content through a same-origin endpoint that strips authentication and applies strict sandboxing.

2. Use separate, non‑shared handlers for authenticated vs. unauthenticated flows

In Chi, configure separate HttpClient instances so that authenticated flows are isolated. This reduces the chance that a misbehaving iframe can reuse credentials via a shared handler cache.

using System.Net.Http.Headers;
using System.Text.Encodings.Web;

// Authenticated client used only for trusted backend calls
var authHandler = new HttpClientHandler
{
    Credentials = new NetworkCredential("user", "s3cr3tPass")
};
authHandler.PreAuthenticate = true;
var authenticatedClient = new HttpClient(authHandler)
{
    BaseAddress = new Uri("https://api.example.com/")
};
authenticatedClient.DefaultRequestHeaders.Authorization =
    new AuthenticationHeaderValue("Basic",
        Convert.ToBase64String(System.Text.Encoding.ASCII.GetBytes("user:s3cr3tPass")));

// Unauthenticated client for public or proxied content — do NOT share this with authenticated flows
var publicClient = new HttpClient { BaseAddress = new Uri("https://public.example.com/") };

3. Explicitly set request credentials instead of relying on default handling

Avoid letting the handler automatically send credentials to any domain. Instead, add the Authorization header only where needed and ensure that redirects and iframes do not inherit it.

using System.Net.Http.Headers;

var client = new HttpClient();
var token = Convert.ToBase64String(System.Text.Encoding.ASCII.GetBytes("user:token123"));
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", token);

// Only make authenticated requests explicitly
var response = await client.GetAsync("https://api.example.com/admin/users");
response.EnsureSuccessStatusCode();
var content = await response.Content.ReadAsStringAsync();

4. Apply sandboxing and anti‑clickjacking protections on the server side

Serve sensitive endpoints with HTTP headers that prevent framing: X-Frame-Options: DENY or Content-Security-Policy: frame-ancestors 'none'. Even when using Chi on the client, ensure your API responses include these headers so that browsers enforce the restriction regardless of client code.

5. Validate and sanitize URL inputs

If your Chi‑based application accepts target URLs (for example, to generate links or fetch resources), reject any that point to authenticated origins or that have a different host than intended. Use strong allow‑lists and avoid parsing URLs manually; prefer Uri and UriBuilder to reduce parsing errors.

// Example input validation
if (!Uri.TryCreate(userSuppliedUrl, UriKind.Absolute, out var uriResult) ||
    !uriResult.Host.EndsWith("example.com", StringComparison.OrdinalIgnoreCase))
{
    throw new ArgumentException("Invalid target URL");
}