Clickjacking in Chi with Dynamodb

Clickjacking is a client-side UI redress attack where an invisible or misleading layer tricks a user into interacting with controls they did not intend to press. Chi, a server-side web framework for the Erlang ecosystem, is often used to render HTML and manage forms. When Chi applications embed third-party or internal endpoints inside inline frames (iframes) without proper frame-ancestor restrictions, and those endpoints interact with Amazon DynamoDB resources, the combination can expose sensitive DynamoDB-driven operations to clickjacking.

Consider a Chi endpoint that renders a form to update a DynamoDB item, perhaps using a helper that reads a record and pre-fills inputs. If this page is served with an overly permissive Content-Security-Policy (CSP) that allows framing by self or *, an attacker can embed the page in an iframe on a malicious site. The attacker can then overlay invisible buttons or links atop the legitimate controls. When the user clicks what they believe is a benign action on the attacker’s page, the Chi page inside the iframe issues a DynamoDB update via a POST request, potentially modifying records the user did not intend to change.

DynamoDB-specific risks arise when the Chi application uses predictable item keys or exposes primary key attributes in URLs or hidden form fields without integrity checks. An attacker may leverage clickjacking to force authenticated users to invoke update operations that the application’s authorization logic mistakenly trusts from the client side. For example, if a Chi route constructs a DynamoDB key from user-supplied parameters without verifying ownership on every request, a forged update can overwrite another user’s data. Because DynamoDB does not enforce per-request UI consent, the vulnerability is mitigated or enabled entirely by how Chi frames and validates requests, not by DynamoDB itself.

In practice, this manifests as unauthorized state changes in DynamoDB-backed resources, such as toggling administrative flags, updating payment methods, or altering linked identities. Because the attack relies on user interaction inside a framed context, logging and monitoring in Chi for unexpected referrers and frame origins becomes important for detection. MiddleBrick’s scans can detect missing frame-ancestor policies and flag endpoints that render forms capable of impacting DynamoDB state without adequate anti-CSRF or framing defenses.

Defending against clickjacking in Chi applications that interact with DynamoDB centers on framing controls and request integrity, not on DynamoDB configuration. The following patterns assume you use the popular chi router and the AWS SDK for JavaScript/TypeScript (v3) to communicate with DynamoDB.

1. Enforce a strict Content-Security-Policy frame-ancestors directive

Ensure that pages performing DynamoDB mutations are not embeddable in third-party frames. In Chi, you can set response headers per route or globally.

;; Define a CSP header that disallows framing except by trusted origins
def csp-header [request respond]
  (respond
    (-> (ring/response "")
        (ring/header "Content-Security-Policy" "frame-ancestors 'self'; report-uri /csp-report"))))

;; Apply to routes that render forms affecting DynamoDB
(Chi/app
  (Chi/routes
    (Chi/GET "/items/:id/edit" request
      (let [item (fetch-dynamodb-item (:id request))]
        (-> (Chi/response (edit-item-html item))
            (ring/header "Content-Security-Policy" "frame-ancestors 'self'"))))
    (Chi/post "/items/:id/update" request
      (let [item (update-dynamodb-item request)]
        (-> (Chi/response "Updated")
            (ring/header "Content-Security-Policy" "frame-ancestors 'self'"))))))

2. Use anti-CSRF tokens and validate referer/origin for DynamoDB writes

Even with CSP, defense-in-depth is recommended. Embed a per-session CSRF token in forms that trigger DynamoDB updates, and validate it on submission. Also verify the HTTP Referer or Origin header on the server side to reject cross-origin requests that should not originate from your Chi application.

;; Generate and validate CSRF token (simplified)
(defn generate-csrf-token []
  (subs (java.util.UUID/randomUUID) 0 16))

(defn validate-csrf [request]
  (let [token (get-in request [:session :csrf-token])
        supplied (:csrf-token (:params request))]
    (= token supplied)))

;; Chi route for DynamoDB update with CSRF check
(Chi/post "/items/:id/update" request
  (if (validate-csrf request)
    (let [item (update-dynamodb-item request)]
      (Chi/response "Update succeeded"))
    (Chi/response "Invalid CSRF token")))

;; fetch-dynamodb-item and update-dynamodb-item using AWS SDK v3
(require '[aws.sdk.dynamodb :as ddb])

(defn fetch-dynamodb-item [id]
  (ddb/get-item {:table-name "MyTable"
                 :key {:id {:s (str id)}}}))

(defn update-dynamodb-item [request]
  (let [id (:id (:params request))
        value (:value (:params request))]
    (ddb/update-item {:table-name "MyTable"
                      :key {:id {:s (str id)}}
                      :update-expression "SET value = :v"
                      :expression-attribute-values {":v" {:s value}}})))

3. Avoid exposing DynamoDB keys in client-side references

Do not place DynamoDB primary key values directly in URLs query strings or hidden form fields without integrity protection. If you must include them, sign or encrypt the values, or map them to opaque session references on the server to prevent tampering that clickjacking could leverage.

MiddleBrick scans can surface endpoints where DynamoDB identifiers are exposed in rendered forms and flag missing frame-ancestors or CSRF protections, helping you prioritize remediation.