Clickjacking in Echo Go with Api Keys

Clickjacking is a client-side attack that tricks a user into interacting with a hidden or disguised UI element while they believe they are interacting with a different page. In Echo Go applications that embed third-party content or expose sensitive actions via predictable routes, clickjacking can be combined with leaked API keys to escalate risk. When an Echo Go handler uses API keys for authorization but relies only on same-origin checks or simple referrer checks, an attacker can embed the application’s authenticated page inside an iframe and overlay invisible controls.

For example, if a route like /admin/keys/regenerate in an Echo Go app validates only the presence of a valid API key in a header and does not enforce strong anti-CSRF protections (e.g., same-site cookies and anti-CSRF tokens), a malicious site can load that page in a transparent iframe. The user, already authenticated via session or API key usage, might inadvertently trigger actions through crafted UI overlays. Because the request includes a valid API key, the server treats the action as legitimate. This becomes particularly dangerous when API keys are passed in headers and the application does not enforce strict Content Security Policy (CSP) frame-ancestors directives, allowing the page to be framed by external origins.

Echo Go handlers that render pages with embedded API key usage must consider that clickjacking can undermine even strong authentication. If the server sets X-Frame-Options inconsistently or omits CSP frame-ancestors, an attacker can frame sensitive UI or API-driven pages. Additionally, if API keys are logged or exposed in browser-side code, the attack surface expands because leaked keys can be reused in conjunction with clickjacked actions. The combination of clickjacking vectors and API key misuse does not directly expose the keys themselves but can lead to unauthorized operations under the permissions granted by those keys.

To identify such issues, scans check whether pages include appropriate frame-protection headers and whether sensitive actions require more than header-based authentication. middleBrick’s 12 checks run in parallel, including Authentication and BOLA/IDOR evaluations, to detect cases where API-key-protected endpoints lack adequate framing protections. The LLM/AI Security module does not test clickjacking directly but supports security awareness by highlighting how social engineering and UI manipulation can compound risks when authentication relies solely on bearer tokens like API keys.

Remediation focuses on layering defenses: prevent framing, enforce strict same-site cookies, validate origins, and avoid relying solely on API keys for state-changing operations. Below are concrete Echo Go examples that demonstrate secure patterns.

Set X-Frame-Options and CSP frame-ancestors

Ensure every response includes headers that prevent the page from being embedded.

import (
    "net/http"
)

func secureMiddleware(next http.Handler) http.Handler {
    return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
        w.Header().Set("X-Frame-Options", "DENY")
        w.Header().Set("Content-Security-Policy", "frame-ancestors 'none'")
        next.ServeHTTP(w, r)
    })
}

func main() {
    e := echo.New()
    e.Use(secureMiddleware)
    e.GET("/admin/keys", func(c echo.Context) error {
        return c.String(http.StatusOK, "keys page")
    })
    e.Start(":8080")
}

Use same-site cookies and anti-CSRF tokens for API key–protected actions

When API keys are used, bind them to a session context and require a CSRF token for any state-changing method.

import (
    "github.com/labstack/echo/v4"
    "github.com/labstack/echo/v4/middleware"
    "net/http"
)

func main() {
    e := echo.New()
    // Use secure, same-site cookies for session management alongside API key validation
    e.Use(middleware.CookieConfig{
        Skipper:      middleware.DefaultSkipper,
        ID:           "session_id",
        Secure:       true,
        HTTPOnly:     true,
        SameSite:     http.SameSiteStrictMode,
    }.Middleware)

    e.POST("/admin/keys/regenerate", func(c echo.Context) error {
        apiKey := c.Request().Header.Get("X-API-Key")
        if apiKey == "" {
            return echo.NewHTTPError(http.StatusUnauthorized, "missing api key")
        }
        csrfToken := c.FormValue("csrf_token")
        if csrfToken == "" {
            return echo.NewHTTPError(http.StatusBadRequest, "missing csrf token")
        }
        // Validate csrfToken against session-bound value before proceeding
        return c.String(http.StatusOK, "key regenerated")
    })
    e.Start(":8080")
}

Validate the Origin and Referer headers for key-sensitive endpoints

Add a middleware that checks the Origin or Referer header for trusted sources, in addition to API key validation.

func originCheck(next echo.HandlerFunc) echo.HandlerFunc {
    return func(c echo.Context) error {
        origin := c.Request().Header.Get("Origin")
        referer := c.Request().Header.Get("Referer")
        allowed := "https://trusted.example.com"
        if origin != allowed && referer != allowed {
            return echo.NewHTTPError(http.StatusForbidden, "invalid origin")
        }
        return next(c)
    }
}

func main() {
    e := echo.New()
    e.Use(originCheck)
    e.DELETE("/api/keys/:id", func(c echo.Context) error {
        apiKey := c.Request().Header.Get("X-API-Key")
        if apiKey == "" {
            return echo.NewHTTPError(http.StatusUnauthorized)
        }
        // perform key deletion logic
        return c.NoContent(http.StatusNoContent)
    })
    e.Start(":8080")
}