Clickjacking in Grape with Mutual Tls

Clickjacking is a client-side attack where an attacker tricks a user into interacting with a transparent or obscured UI element embedded inside an iframe. Grape is a REST-like API micro-framework for Ruby that typically renders JSON, but when it serves HTML views or mixes HTML endpoints with API routes, it can be exposed. Mutual TLS (mTLS) secures transport by requiring client certificates, but it does not protect against clickjacking because mTLS operates at the connection layer and does not enforce how content is rendered or framed.

When Grape endpoints are accessible over mTLS (e.g., a service requiring client certificates), an attacker can still embed those endpoints in an iframe if the response lacks anti-clickjacking defenses. The mTLS handshake succeeds, and the browser loads the trusted content inside the malicious page. Because mTLS confirms the identity of the client and server, users may mistakenly assume the embedded content is safe, increasing the risk of unintended actions such as changing settings or invoking privileged operations.

Crucially, middleBrick scans identify this class of risk under its "BFLA/Privilege Escalation" and "Input Validation" checks by analyzing response headers and rendered behavior without assuming transport-layer protections mitigate UI redressing. Even when mTLS is enforced, missing X-Frame-Options or Content-Security-Policy headers allow Grape apps to be framed, enabling successful clickjacking despite strong client authentication.

To remediate clickjacking in Grape while using mTLS, you must enforce framing controls at the HTTP response level. mTLS should remain in place for transport security, but you must explicitly prevent your endpoints from being embedded. Below are Grape code examples that combine mTLS awareness with anti-clickjacking headers.

Ensure your Grape API sets X-Frame-Options and Content-Security-Policy headers. If your Grape service is behind a proxy or load balancer that terminates mTLS, make sure those headers are applied after authentication so they are present for all API responses.

require 'grape'

class MyApi < Grape::API
  format :json

  before do
    # Enforce anti-clickjacking headers for all responses
    header['X-Frame-Options'] = 'DENY'
    # Use CSP frame-ancestors to allow framing only by trusted origins (if framing is required)
    header['Content-Security-Policy'] = "frame-ancestors 'none'"
  end

  get :public_data do
    { data: 'This cannot be framed' }
  end
end

If your Grape app serves HTML views (e.g., via grape-entity or templates), apply the same headers to those responses. For environments where controlled embedding is necessary (rare for APIs), use a restrictive CSP instead of DENY:

header['Content-Security-Policy'] = "frame-ancestors 'self' https://trusted.example.com"

Combine these headers with mTLS by ensuring your authentication layer validates client certificates before the request reaches Grape routes. middleBrick’s scans can verify that both mTLS enforcement and framing protections are present by checking response headers across authenticated and unauthenticated paths, highlighting missing defenses that could permit clickjacking despite transport-layer security.