Clickjacking in Rails with Cockroachdb

Clickjacking is a client-side UI vulnerability where an attacker tricks a user into clicking a transparent or disguised element within a page. In a Rails application using Cockroachdb as the database, the risk does not stem from the database itself, but from how Rails renders views and how the application handles framing and HTTP headers. Cockroachdb, as a distributed SQL database, does not enforce HTTP security policies; therefore, if Rails controllers do not set appropriate protections, an attacker can embed sensitive Cockroachdb-backed forms or admin pages inside an <iframe> and overlay interactive elements to hijack actions.

When Rails serves pages that perform state-changing operations (e.g., fund transfers, user role updates) without anti-CSRF tokens or without the X-Frame-Options/Content-Security-Policy headers, clickjacking becomes viable. Cockroachdb’s strong consistency and transactional guarantees mean that if an authenticated Rails request executes a sensitive SQL mutation, that mutation will reliably persist. An attacker does not need to exploit Cockroachdb directly; they rely on the Rails app’s lack of frame-protection headers and missing CSRF safeguards to trick the authenticated user’s browser into submitting requests that the database will faithfully execute.

Consider a Rails controller that performs a money transfer using an ActiveRecord model backed by a Cockroachdb table. If the transfer form is rendered without a CSRF token and is served with default headers that allow framing, an attacker can craft a malicious page that overlays a ‘Confirm Transfer’ button on top of an invisible iframe containing the real form. The user’s authenticated session will include the necessary cookies, and Cockroachdb will commit the transaction as intended by the attacker. MiddleBrick scans can detect missing security headers and missing CSRF protections in Rails endpoints, highlighting clickjacking risks in the findings report.

Remediation focuses on Rails-side defenses, as Cockroachdb does not provide HTTP header controls. Ensure every form that changes state includes <%= csrf_meta_tags %> and that controllers verify authenticity. Additionally, enforce strict framing policies via response headers and a strong Content Security Policy.

1. CSRF Protection with ActiveRecord on Cockroachdb

Rails’ built-in CSRF protection works with any database, including Cockroachdb. Ensure forms include the authenticity token and that controllers do not skip protect_from_forgery.

class TransfersController < ApplicationController
  protect_from_forgery with: :exception

  def create
    # ActiveRecord model backed by a Cockroachdb table
    @transfer = Transfer.new(transfer_params)
    if @transfer.save
      redirect_to confirmation_path, notice: 'Transfer completed'
    else
      render :new
    end
  end

  private

  def transfer_params
    params.require(:transfer).permit(:amount, :destination_account)
  end
end

View example with CSRF token in a form that persists to Cockroachdb:

<%= form_with model: @transfer, url: transfers_path, local: true do |f| %>
  <%= hidden_field_tag :authenticity_token, form_authenticity_token %>
  <%= f.label :amount %>
  <%= f.number_field :amount, step: '0.01' %>
  <%= f.label :destination_account %>
  <%= f.text_field :destination_account %>
  <%= f.submit 'Transfer Funds' %>
<% end %>

2. HTTP Headers to Prevent Clickjacking

Set X-Frame-Options and a restrictive Content Security Policy in a Rails initializer or application controller to prevent embedding.

# config/initializers/frame_options.rb
Rails.application.config.action_dispatch.default_headers.merge!(
  'X-Frame-Options' => 'DENY',
  'Content-Security-Policy' => "frame-ancestors 'none';"
)

If you must allow framing from specific origins (e.g., an internal dashboard), use a CSP with specific URIs instead of 'none':

# Allow framing only from same origin
Rails.application.config.action_dispatch.default_headers.merge!(
  'Content-Security-Policy' => "frame-ancestors 'self' https://trusted.example.com;"
)

3. Strong Parameters and Database Safety

Even with Cockroachdb’s transactional integrity, validate and sanitize inputs in Rails to prevent unintended updates. Combine strong parameters with verification steps.

def update_account_role
  @user = User.find(params[:id])
  if params[:user][:role].in?(%w[admin user guest])
    @user.update!(user_params)
    redirect_to @user, notice: 'Role updated'
  else
    redirect_to @user, alert: 'Invalid role'
  end
end