Clickjacking in Echo Go with Basic Auth

Clickjacking is a client-side UI redress attack where an invisible or disguised page element tricks a user into performing an unintended action. In Echo Go applications that use HTTP Basic Authentication, combining traditional session-based flows with Basic Auth headers can expose interfaces to clickjacking when responses are not protected by anti-clickjacking headers or frame controls.

When an Echo Go service accepts Basic Auth credentials via request headers and renders HTML pages (for example, a status or admin page), those pages may be embedded in an attacker-controlled site using an <iframe>. If the application does not set X-Frame-Options or Content-Security-Policy: frame-ancestors, the browser will render the page inside the iframe. An attacker can layer transparent UI elements on top of the iframe to capture credentials or force authenticated actions without user awareness.

Because Basic Auth credentials are sent with every request to the protected origin, any page reachable under that origin—including pages rendered in an unauthorized frame—carries the authentication context. This means a clickjacking vector can leverage the persistent nature of Basic Auth across requests, making the attack more dangerous: a user who has already supplied credentials may still be tricked into interacting with a framed, invisible form or button. The risk is compounded when the application serves both API endpoints and HTML views from the same route patterns, as an attacker can target the HTML view while the credentials remain valid for the entire origin.

Echo Go does not automatically enforce frame restrictions; developers must explicitly configure middleware or handlers. Without such controls, an application that issues Basic Auth challenges and serves HTML is implicitly trusting that clients will enforce framing rules, which browsers may not apply consistently across contexts or legacy user agents.

Remediation focuses on preventing the authenticated page from being embedded and ensuring that Basic Auth is used only over secure, same-origin contexts where framing risks are controlled. The following examples assume you are using the standard net/http package with the github.com/labstack/echo/v4 framework.

1. Set anti-clickjacking headers on all responses

For HTML responses, explicitly set headers to prevent framing. Use either X-Frame-Options or Content-Security-Policy. In Echo Go, add middleware to apply these headers globally.

package main

import (
	"net/http"
	"github.com/labstack/echo/v4"
	"github.com/labstack/echo/v4/middleware"
)

func main() {
	e := echo.New()

	// Recommended: Use CSP frame-ancestors for fine-grained control
	e.Use(middleware.CORSWithConfig(middleware.CORSConfig{
		AllowOrigins: []string{"https://your-trusted-domain.com"},
		AllowHeaders: []string{echo.HeaderAuthorization},
	}))

	// Apply CSP to prevent framing by any ancestor
	e.Use(middleware.ContentSecurityPolicy([]string{
		"default-src 'self'",
		"script-src 'self' 'unsafe-inline'",
		"style-src 'self' 'unsafe-inline'",
		"img-src 'self' data:",
		"frame-ancestors 'none'", // Prevents embedding in any frame
	}))

	// Alternatively, for broader legacy support, set X-Frame-Options
	e.Use(middleware.CustomFunc(func(next echo.HandlerFunc) echo.HandlerFunc {
		return func(c echo.Context) error {
			c.Response().Header().Set(echo.HeaderXFrameOptions, "DENY")
			return next(c)
		}
	}))

	// Routes
	e.GET("/status", statusHandler)
	e.Start(":8080")
}

func statusHandler(c echo.Context) error {
	return c.HTML(http.StatusOK, "<h1>Status</h1>")
}

2. Restrict Basic Auth to API routes and avoid mixing with embeddable HTML

Use middleware to enforce Basic Auth only on API paths and ensure HTML pages are served from a separate, explicitly framed or non-framed context. Do not serve HTML pages that respond to Basic Auth on routes that could be embedded.

package main

import (
	"net/http"
	"github.com/labstack/echo/v4"
)

// Basic Auth middleware for API routes
func basicAuthMiddleware(next echo.HandlerFunc) echo.HandlerFunc {
	return func(c echo.Context) error {
		user, pass, ok := c.Request().BasicAuth()
		if !ok || !checkCredentials(user, pass) {
			return c.String(http.StatusUnauthorized, "Unauthorized")
		}
		return next(c)
	}
}

func checkCredentials(user, pass string) bool {
	// Replace with secure credential validation
	return user == "admin" && pass == "securepass"
}

func main() {
	e := echo.New()

	// API group with Basic Auth
	a := e.Group("/api")
	a.Use(basicAuthMiddleware)
	{
		a.GET("/data", func(c echo.Context) error {
			return c.JSON(http.StatusOK, map[string]string{"status": "ok"})
		})
	}

	// Public HTML pages without Basic Auth; still enforce CSP framing rules
	e.GET("/", func(c echo.Context) error {
		return c.HTML(http.StatusOK, "<h1>Public Page</h1>")
	})

	e.Logger.Fatal(e.Start(":8080"))
}

3. Use HTTPS and avoid sending Basic Auth over insecure channels

Always serve your Echo Go application over TLS. Basic Auth credentials are base64-encoded, not encrypted, and are only as secure as the transport. Combine headers with HTTPS to reduce both interception and clickjacking risk vectors.