Clickjacking in Hanami

Clickjacking attacks exploit the way browsers render content within frames, allowing malicious sites to trick users into interacting with hidden or disguised elements. In Hanami applications, this vulnerability typically emerges when the framework's default configuration or custom views fail to properly restrict frame embedding.

Hanami's architecture makes certain clickjacking scenarios particularly insidious. When building Hanami applications, developers often create complex dashboard interfaces or admin panels that aggregate data from multiple sources. Without proper frame-busting headers, these interfaces can be loaded within an attacker's malicious iframe on a third-party site.

The attack vectors in Hanami applications often follow predictable patterns. Consider an admin interface that manages user permissions or processes financial transactions. An attacker could embed this interface within a carefully crafted page, overlaying invisible buttons or forms on top of legitimate content. When users believe they're clicking a harmless button on the attacker's site, they're actually triggering actions in your Hanami application.

Hanami's view rendering system, while powerful, can inadvertently expose applications to clickjacking when using partials or nested layouts. If a view component that handles sensitive operations lacks proper frame restrictions, it becomes vulnerable regardless of how it's accessed. This is especially problematic in applications using Hanami's view inheritance, where a base view might define layout behavior that child views inherit without proper security considerations.

Real-world scenarios include attackers creating fake login pages that overlay your actual Hanami authentication form, harvesting credentials when users attempt to log in. Another common attack involves payment processing interfaces where users think they're confirming a purchase on the legitimate site, but are actually authorizing unauthorized transactions through the embedded iframe.

The X-Frame-Options header, which Hanami doesn't set by default, becomes critical here. Without it, any site can embed your application's pages, making clickjacking trivial. Similarly, Content-Security-Policy frame-ancestors directives provide granular control over which origins can embed your content, but require explicit configuration in Hanami applications.

Detecting clickjacking vulnerabilities in Hanami applications requires examining both the framework's default behavior and your application's specific configurations. Start by inspecting your Hanami application's HTTP response headers using curl or browser developer tools:

curl -I https://your-hanami-app.com/admin

Look for the absence of X-Frame-Options and Content-Security-Policy headers with appropriate frame-ancestors directives. Hanami's default Rack configuration doesn't include these headers, leaving applications exposed.

middleBrick's scanning approach for Hanami applications is particularly effective because it tests the unauthenticated attack surface. The scanner sends requests to your API endpoints and analyzes HTTP responses for missing security headers. For clickjacking specifically, middleBrick checks:

• Presence and correctness of X-Frame-Options header (DENY or SAMEORIGIN)
• Content-Security-Policy frame-ancestors directive configuration
• Meta tag implementations in HTML responses
• JavaScript-based frame-busting attempts and their effectiveness

middleBrick's LLM/AI Security module adds another layer of detection for Hanami applications that might expose AI endpoints. If your Hanami application includes AI features or integrates with language models, middleBrick tests for system prompt leakage and prompt injection vulnerabilities that could be exploited in conjunction with clickjacking attacks.

For Hanami applications using websockets or real-time features, middleBrick's scanning also verifies that these connections aren't vulnerable to clickjacking through improper frame handling. This is particularly relevant for Hanami applications using Action Cable or similar real-time communication libraries.

Manual testing complements automated scanning. Create a simple HTML page on a different domain that attempts to iframe your Hanami application's sensitive endpoints. If the content loads without restrictions, your application is vulnerable. middleBrick automates this process and provides detailed findings with severity levels and remediation guidance.

Securing Hanami applications against clickjacking requires implementing multiple defense layers. The most effective approach combines HTTP header configuration with Hanami-specific middleware and view-level protections.

Start with HTTP response headers in your Hanami application. Create a security middleware that sets appropriate headers globally: