Clickjacking in Laravel (Php)

Clickjacking is a client-side injection pattern where an attacker tricks a user into clicking a transparent or hidden UI element inside an iframe while the user believes they are interacting with a legitimate page. In a Laravel application written in Php, the risk arises when responses do not enforce frame-embedding restrictions, allowing the app’s pages to be loaded inside an attacker-controlled page. Because Laravel does not set frame-protection headers by default, any view that renders sensitive actions—such as a fund transfer form or a privileged button—can be embedded invisibly and abused via overlays or iframes.

When a browser loads a Laravel-rendered page inside a malicious frame, user interactions like clicking a submit button can be captured and relayed to the target endpoint. This is especially relevant when CSRF protections are incomplete or when the application relies solely on same-origin checks without anti-CSRF tokens. Although Laravel’s built-in CSRF middleware adds tokens to forms, clickjacking can still lead to unauthorized actions if the UI itself is manipulated via framing. The risk is compounded when sensitive pages lack explicit X-Frame-Options or Content-Security-Policy frame-ancestors directives, which are essential for preventing the page from being rendered in a frame at all.

In practice, an attacker may host a page that embeds https://api.yourservice.com/admin/confirm-action inside an iframe, overlaying invisible controls or misleading labels. If the Laravel app does not validate the Referer header or enforce strict frame-ancestors policies, the user’s authenticated session can be leveraged without their awareness. MiddleBrick’s scanning checks for missing frame-protection headers as part of its security checks, highlighting the importance of explicitly defining who may embed your endpoints.

Securing a Laravel application written in Php requires explicit header-based defenses and careful configuration of CSP. The most direct mitigation is to set X-Frame-Options to deny or sameorigin, and to define a strict Content-Security-Policy with frame-ancestors. In Laravel, this can be achieved globally via middleware or within specific route groups to ensure that sensitive endpoints are never embeddable.

Below is a concrete example of a middleware that adds frame-protection headers in Php for Laravel. This approach ensures that all responses include the necessary defenses unless explicitly overridden for trusted embedding scenarios.

<?php

namespace App\Http\Middleware;

use Closure;
use Illuminate\Http\Request;

class FrameProtectionMiddleware
{
    /**
     * Handle an incoming request.
     *
     * @param  \Illuminate\Http\Request  $request
     * @param  \Closure  $next
     * @return mixed
     */
    public function handle(Request $request, Closure $next)
    {
        $response = $next($request);

        // Prevent embedding in any frame
        $response->headers->set('X-Frame-Options', 'DENY');

        // Alternatively, allow embedding only from same origin:
        // $response->headers->set('X-Frame-Options', 'SAMEORIGIN');

        // Content-Security-Policy frame-ancestors directive (modern approach)
        $response->headers->set('Content-Security-Policy', "frame-ancestors 'self';");

        return $response;
    }
}

After creating the middleware, register it in app/Http/Kernel.php within the web or api middleware group, depending on which routes require protection. For highly specific actions—such as a webhook endpoint that must be embeddable by a trusted partner—you can selectively exclude the middleware and instead set a tailored CSP with specific URIs in the frame-ancestors directive.

It is also important to validate the Referer header on critical state-changing requests as an additional layer, though this should complement rather than replace frame-protection headers. Below is a simple example in Php showing how to enforce a same-origin referer check within a controller method:

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;

class PaymentController extends Controller
{
    public function confirm(Request $request)
    {
        $referer = $request->headers->get('Referer');
        $expectedHost = 'https://api.yourservice.com';

        if (! str_starts_with($referer, $expectedHost)) {
            return response('Invalid request origin', 403);
        }

        // Proceed with secure action logic
        return view('confirmation');
    }
}

By combining these Php-specific patterns—X-Frame-Options, Content-Security-Policy frame-ancestors, and careful origin validation—you can effectively neutralize clickjacking risks in Laravel. Regular scans with tools like MiddleBrick help verify that headers are present and correctly configured across all endpoints.