Clickjacking in Django with Basic Auth

Clickjacking is a client-side attack where an attacker tricks a user into interacting with a hidden or disguised UI element inside an invisible frame. When Basic Authentication is used in Django, the browser may automatically attach credentials to any request for a protected origin, including requests initiated by an attacker’s page via an embedded frame. This means a user logged in with Basic Auth can unknowingly perform privileged actions (such as changing settings or confirming a transaction) on your Django app while browsing a malicious site.

Django’s default behavior does not prevent framing unless explicitly configured. If your views rely solely on Basic Auth and do not set anti-clickjacking headers or frame-busting controls, an attacker can embed your endpoint in an <iframe> and overlay interactive elements on top, leading to unauthorized operations. This risk is especially pronounced with Basic Auth because credentials are sent with every request to the protected domain, and there is no session expiration mechanism like token rotation. The combination of persistent credentials and absent frame restrictions creates a clear path for unauthorized actions driven by user interaction alone.

Consider a Django view that performs a sensitive operation (e.g., changing an admin flag) and relies only on HTTP Basic Auth for access control. An attacker can craft a page that loads this endpoint in a hidden iframe and position UI elements (buttons, inputs) over the visible portion of the page. When the victim interacts with what they believe is a benign site, they are actually clicking or submitting within the hidden frame, and the browser automatically includes the Basic Auth credentials. Because Django does not enforce a same-origin policy at the frame level by default, the request succeeds if the endpoint does not validate the request context beyond authentication.

To detect this class of issue, scanning tools evaluate whether your Django app sets X-Frame-Options or Content-Security-Policy frame-ancestors, whether sensitive actions require additional re-authentication, and whether the authentication mechanism leaks credentials to embedded contexts. Without explicit mitigations, an unauthenticated scan can surface the absence of frame-protection headers as a finding, highlighting that Basic Auth alone is insufficient to defend against clickjacking.

Remediation focuses on two areas: preventing your pages from being embedded and strengthening authentication context for sensitive actions. You should set anti-clickjacking headers and add frame-busting JavaScript for legacy browsers, while ensuring that Basic Auth is used over HTTPS and that critical endpoints require additional verification.

1) Set security headers to restrict framing. In Django, you can use middleware or a decorator to add the following headers:

X-Frame-Options: DENY
Content-Security-Policy: frame-ancestors 'none'

2) Implement a middleware to apply headers globally. Example:

from django.utils.deprecation import MiddlewareMixin

class SecurityHeadersMiddleware(MiddlewareMixin):
    def process_response(self, request, response):
        response['X-Frame-Options'] = 'DENY'
        response['Content-Security-Policy'] = "frame-ancestors 'none'"
        return response

Register the middleware in settings.py:

MIDDLEWARE = [
    # ...
    'path.to.SecurityHeadersMiddleware',
]

3) For views that must be embeddable (e.g., public widgets), use a less restrictive policy and add frame-busting JavaScript on the page itself:

<script>
  if (self !== top) {
    top.location = self.location;
  }
</script>

4) Combine Basic Auth with CSRF protections for state-changing operations. Even though Basic Auth is not a cookie-based session, Django’s CSRF middleware can still protect POST requests if you include the CSRF token. Example view that requires both authentication and a valid CSRF token for a sensitive action:

from django.contrib.auth.decorators import login_required
from django.views.decorators.csrf import csrf_protect
from django.http import JsonResponse

@login_required
@csrf_protect
def sensitive_action(request):
    if request.method == 'POST':
        # Perform the action
        return JsonResponse({'status': 'ok'})
    return JsonResponse({'error': 'use POST'}, status=405)

5) Use HTTPS to prevent credential interception and avoid embedding sensitive endpoints in third-party pages. If you must allow limited embedding, scope frame-ancestors to trusted domains only:

Content-Security-Policy: frame-ancestors 'self' https://trusted.example.com;

6) Consider deprecating Basic Auth for interactive user flows in favor of token-based authentication with short lifetimes, which reduces the blast radius of a clickjacking attack by limiting credential persistence and enabling more granular re-authentication challenges.