Clickjacking in Fiber
How Clickjacking Manifests in Fiber
Clickjacking in Fiber applications occurs when an attacker tricks users into clicking on a hidden or disguised element, causing them to perform unintended actions on your Fiber API's frontend interface. This attack vector exploits the trust users have in legitimate applications by overlaying malicious content on top of your Fiber-rendered pages.
In Fiber applications, clickjacking typically manifests through several specific attack patterns:
- UI Redress Attacks: An attacker creates an invisible iframe containing your Fiber application and overlays it with deceptive content, making users believe they're interacting with one element while actually clicking on your application's buttons or forms.
- Credential Harvesting: Malicious sites embed your Fiber login page in an iframe with zero opacity, capturing user credentials when they attempt to authenticate.
- Unauthorized Transactions: Financial or data modification operations in Fiber apps can be triggered without user awareness when combined with social engineering tactics.
- CSRF Bypass: While clickjacking is distinct from CSRF, it can be used to bypass CSRF protections by directly manipulating the user's browser through their own clicks.
The vulnerability is particularly dangerous in Fiber applications because Go's web framework doesn't include clickjacking protections by default. Developers must explicitly implement defenses, and many overlook this critical security header.
package main
import (
"github.com/gofiber/fiber/v2"
"github.com/gofiber/fiber/v2/middleware/cors"
)
func main() {
app := fiber.New()
app.Use(cors.New())
// Vulnerable endpoint - no clickjacking protection
app.Get("/dashboard", func(c *fiber.Ctx) error {
return c.SendString("Welcome to Dashboard
")
})
app.Listen(":3000")
}
This Fiber application is vulnerable because it doesn't set the X-Frame-Options header, allowing any website to embed it in an iframe and perform clickjacking attacks.
Fiber-Specific Detection
Detecting clickjacking vulnerabilities in Fiber applications requires examining both the HTTP response headers and the application's configuration. Here are the specific detection methods:
Header Analysis: The primary indicator is the absence of X-Frame-Options or Content-Security-Policy frame-ancestors directives. Use curl or HTTP inspection tools to check responses:
curl -I https://your-fiber-app.com
Look for these headers in the response:
X-Frame-Options: DENY
X-Frame-Options: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'none'
Content-Security-Policy: frame-ancestors 'self'
middleBrick Scanner Detection: middleBrick's black-box scanning approach specifically tests for clickjacking vulnerabilities by attempting to load your Fiber endpoints in iframes and checking for appropriate security headers. The scanner runs 12 parallel security checks including frame injection tests that attempt to embed your API endpoints.
Automated Testing: Create test cases that verify header presence:
package main
import (
"github.com/gofiber/fiber/v2"
"testing"
"net/http/httptest"
)
func TestClickjackingProtection(t *testing.T) {
app := fiber.New()
// Your Fiber routes here
// Test for X-Frame-Options
w := httptest.NewRecorder()
req := httptest.NewRequest("GET", "/dashboard", nil)
app.Handler()(w, req)
if w.Header().Get("X-Frame-Options") == "" {
t.Errorf("Missing X-Frame-Options header")
}
}
Manual Verification: Create a simple HTML page that attempts to embed your Fiber application:
Clickjacking Test
If your Fiber app loads in this iframe without restrictions, it's vulnerable to clickjacking.
middleBrick Integration: For continuous security monitoring, integrate middleBrick into your Fiber development workflow. The GitHub Action can automatically scan your staging environment before deployment, ensuring clickjacking protections are in place:
name: Security Scan
on: [push, pull_request]
jobs:
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- name: Run middleBrick Scan
uses: middleBrick/middlebrick-action@v1
with:
url: http://staging.your-app.com
token: ${{ secrets.MIDDLEBRICK_TOKEN }}
continue-on-error: true
Fiber-Specific Remediation
Remediating clickjacking vulnerabilities in Fiber applications involves implementing proper HTTP headers and understanding Fiber's middleware system. Here are the specific approaches:
Middleware Implementation: The most effective approach is creating a reusable middleware that adds clickjacking protection headers:
package main
import (
"github.com/gofiber/fiber/v2"
)
// ClickjackingProtection middleware adds X-Frame-Options header
func ClickjackingProtection() fiber.Handler {
return func(c *fiber.Ctx) error {
// DENY prevents framing from any origin
c.Set("X-Frame-Options", "DENY")
// Alternative: SAMEORIGIN allows framing only from same origin
// c.Set("X-Frame-Options", "SAMEORIGIN")
// Alternative: CSP frame-ancestors (modern approach)
// c.Set("Content-Security-Policy", "frame-ancestors 'none'")
return c.Next()
}
}
func main() {
app := fiber.New()
// Apply globally to all routes
app.Use(ClickjackingProtection())
app.Get("/dashboard", func(c *fiber.Ctx) error {
return c.SendString("Secure Dashboard
")
})
app.Listen(":3000")
}
Route-Specific Protection: For applications requiring different clickjacking policies per endpoint, apply middleware selectively:
package main
import (
"github.com/gofiber/fiber/v2"
)
func ClickjackingDeny() fiber.Handler {
return func(c *fiber.Ctx) error {
c.Set("X-Frame-Options", "DENY")
return c.Next()
}
}
func ClickjackingSameOrigin() fiber.Handler {
return func(c *fiber.Ctx) error {
c.Set("X-Frame-Options", "SAMEORIGIN")
return c.Next()
}
}
func main() {
app := fiber.New()
// Protected routes
app.Use("/admin", ClickjackingDeny())
app.Use("/api/*", ClickjackingDeny())
// Public routes with less strict policy
app.Use("/public", ClickjackingSameOrigin())
app.Get("/admin/dashboard", func(c *fiber.Ctx) error {
return c.SendString("Admin Dashboard
")
})
app.Listen(":3000")
}
Content Security Policy (CSP) Approach: For modern browsers, CSP provides more granular control and is the recommended approach:
package main
import (
"github.com/gofiber/fiber/v2"
)
func ClickjackingCSP() fiber.Handler {
return func(c *fiber.Ctx) error {
// Prevent framing from any origin
c.Set("Content-Security-Policy", "frame-ancestors 'none'")
// Alternative: Allow same origin only
// c.Set("Content-Security-Policy", "frame-ancestors 'self'")
return c.Next()
}
}
func main() {
app := fiber.New()
app.Use(ClickjackingCSP())
app.Get("/secure-endpoint", func(c *fiber.Ctx) error {
return c.SendString("Secure Content
")
})
app.Listen(":3000")
}
Testing Your Protection: After implementing clickjacking protection, verify it works:
package main
import (
"github.com/gofiber/fiber/v2"
"testing"
"net/http/httptest"
)
func TestClickjackingHeaders(t *testing.T) {
app := fiber.New()
app.Use(ClickjackingProtection())
w := httptest.NewRecorder()
req := httptest.NewRequest("GET", "/test", nil)
app.Handler()(w, req)
if w.Header().Get("X-Frame-Options") != "DENY" {
t.Errorf("Expected X-Frame-Options: DENY, got: %s", w.Header().Get("X-Frame-Options"))
}
}
middleBrick Verification: After implementing these protections, use middleBrick to verify your fixes. The scanner will attempt to load your endpoints in iframes and check for proper security headers, providing a security score and detailed findings about any remaining vulnerabilities.