Clickjacking in Gin with Api Keys

Clickjacking is a client-side UI redress attack in which an invisible or disguised element (often an iframe) tricks a user into interacting with a page they did not intend to interact with. In a Gin-based API service that exposes endpoints protected only by API keys, clickjacking can become relevant when the API is used by a web frontend that consumes those endpoints. If the frontend embeds third-party content or includes unprotected routes in iframes, and the API relies solely on static API keys for access control, an attacker can embed the protected endpoint in a malicious page. Because API keys are often passed in headers or query parameters, they are not automatically protected from being sent in cross-origin contexts when credentials or tokens are involved, and the frontend may inadvertently trigger requests from the user’s authenticated session.

Consider a Gin route that returns sensitive data and is protected by an API key passed as a query parameter or header. If a developer builds an admin dashboard that calls this route inside an iframe to embed live metrics, and the browser sends the API key automatically via headers or cookies (depending on how the request is issued), an attacker hosting a page with an invisible iframe pointing to that dashboard can cause the user’s browser to make authenticated requests on their behalf. While API keys themselves are not cookies, if the frontend stores the key in local storage or a header and the browser includes credentials in cross-origin requests (e.g., with withCredentials), the request can be hijacked via clickjacking. This is especially relevant when the API is designed for web clients and does not enforce strict anti-CSRF or anti-frame protections, effectively exposing the unauthenticated attack surface that middleBrick scans for.

middleBrick’s 12 security checks, including the BOLA/IDOR and Input Validation tests, help surface whether endpoints inadvertently accept cross-origin requests without proper framing defenses. Although middleBrick does not fix or block, it reports findings with remediation guidance, which is important when API keys are used in frontend-integrated scenarios. In architectures where API keys are the primary protection mechanism, clickjacking becomes a concern not because the key is leaked directly, but because the browser’s automatic credential handling can allow forged user actions to be executed against protected Gin endpoints.

To mitigate clickjacking risks in Gin when using API keys, combine secure key handling with anti-clickjacking defenses in the web frontend and strict CORS/referrer policies on the server. Below are concrete, working examples for a Gin-based API that uses API keys for authentication.

First, implement a middleware that validates the presence and correctness of an API key. Store the key securely on the client (e.g., in an httpOnly cookie or a secure environment variable) and avoid exposing it in local storage when possible. On the server side, ensure the API does not rely solely on static keys without additional context validation.

package main

import (
    "net/http"
    "strings"

    "github.com/gin-gonic/gin"
)

const validAPIKey = "my-secure-api-key-12345"

func apiKeyMiddleware() gin.HandlerFunc {
    return func(c *gin.Context) {
        // Accept key via Authorization: ApiKey <key> or query param key
        auth := c.GetHeader("Authorization")
        var key string
        if strings.HasPrefix(auth, "ApiKey ") {
            key = strings.TrimPrefix(auth, "ApiKey ")
        } else {
            key = c.Query("key")
        }
        if key != validAPIKey {
            c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "invalid api key"})
            return
        }
        c.Next()
    }
}

func main() {
    r := gin.Default()
    r.Use(apiKeyMiddleware())

    r.GET("/admin/metrics", func(c *gin.Context) {
        c.JSON(http.StatusOK, gin.H{"metrics": "safe data"})
    })

    r.Run(":8080")
}

To defend against clickjacking in the consuming web application, set HTTP headers that prevent framing. While these headers are typically enforced by browsers for the frontend, ensure your API responses include X-Frame-Options and Content-Security-Policy where relevant. For APIs consumed by SPAs, prefer anti-CSRF tokens and strict CORS rules instead of relying on API keys alone.

// Optionally set security headers in Gin responses
r.Use(func(c *gin.Context) {
    c.Writer.Header().Set("X-Frame-Options", "DENY")
    c.Writer.Header().Set("Content-Security-Policy", "frame-ancestors 'none'")
    c.Next()
})

Additionally, avoid using GET endpoints for sensitive actions that can be triggered via an iframe, and require explicit referrer checks or custom anti-CSRF headers for state-changing operations. middleBrick’s scans can highlight endpoints that lack these protections, providing prioritized findings and remediation guidance.