Clickjacking in Rocket with Hmac Signatures

Clickjacking is a client-side UI redress attack where an attacker tricks a user into interacting with a hidden or disguised element inside an embedded frame. When Rocket applications embed HTTP responses inside <iframe> or <frame> elements without protection, and also use Hmac Signatures strictly for data integrity (e.g., signing request parameters or tokens) without anti-clickjacking defenses, the attack surface can be widened.

Hmac Signatures in Rocket are commonly used to verify the authenticity of requests, query strings, or API tokens. If a Rocket endpoint validates an Hmac Signature to authorize an action (such as a state-changing request) but does not prevent the page from being embedded, an attacker can lure a victim into clicking buttons or links that trigger those signed requests inside a malicious frame. The browser sends the valid cookie/session alongside the forged frame submission; if the server trusts the Hmac Signature without additional context checks (like frame-busting or anti-CSRF tokens), the signed request may be processed as intended by the user. This is a contextual risk: Hmac Signatures protect integrity and authentication but do not inherently prevent UI redressing; without explicit anti-clickjacking controls, the signed flow can be abused through social engineering.

For example, a Rocket handler that accepts a signed query parameter to perform a fund transfer might validate the Hmac but still render a page that can be embedded. An attacker crafts a page that overlays a transparent button aligned with the transfer action inside an iframe, and the user’s click on a benign site submits the signed request unintentionally. Because the signature is valid and the request appears legitimate, the server processes the transfer. This illustrates that Hmac Signatures alone are insufficient to mitigate clickjacking; they must be complemented by anti-framing headers and secure rendering practices.

To detect such risks, scans evaluate whether pages with Hmac-signed actions are served with appropriate framing protections and whether sensitive operations rely solely on signatures without secondary CSRF or frame-embedding defenses. The scan checks for the presence of Content-Security-Policy frame-ancestors, X-Frame-Options, or X-Content-Type-Options, and whether forms or state-changing endpoints that use Hmac Signatures are exposed to embedding.

Remediation centers on two layers: preventing embedding of sensitive pages and ensuring Hmac Signatures are used in a context that cannot be forged via a frame. Below are concrete code examples in Rocket to implement anti-clickjacking headers and robust Hmac verification.

1. Anti-clickjacking headers in Rocket

Set security headers to prohibit framing of sensitive routes. Use the Responder::configure or a fairing to inject headers.

use rocket::http::Header;
use rocket::{Request, Response};

#[rocket::main]
async fn main() {
    rocket::build()
        .attach(SecurityHeaders)
        .mount("/", routes![index])
        .launch()
        .await;
}

struct SecurityHeaders;

#[rocket::async_trait]
impl rocket::fairing::Fairing for SecurityHeaders {
    fn info(&self) -> rocket::fairing::Info {
        rocket::fairing::Info {
            name: "Security Headers",
            kind: rocket::fairing::Kind::Response,
        }
    }

    async fn on_response(&self, _: &Request<_>, response: &mut Response) {
        // Prevent embedding in any context
        response.set_header(Header::new("X-Frame-Options", "DENY"));
        // Modern alternative: restrict to same-origin only
        response.set_header(Header::new("Content-Security-Policy", "frame-ancestors 'self'"));
        // Additional protection for MIME-sniffing
        response.set_header(Header::new("X-Content-Type-Options", "nosniff"));
    }
}

2. Hmac Signature verification with anti-replay and context binding

When using Hmac Signatures, bind the signature to the request context (method, path, timestamp, and a nonce) and include anti-replay checks to prevent captured requests from being reused in a frame-initiated context.

use rocket::serde::json::Json;
use rocket::{get, post, routes};
use hmac::{Hmac, Mac};
use sha2::Sha256;
use std::time::{SystemTime, UNIX_EPOCH};

type HmacSha256 = Hmac<Sha256>;

const SECRET: &[u8] = b"super-secret-key-change-me";

#[derive(rocket::serde::Deserialize)]
struct SignedRequest {
    action: String,
    timestamp: u64,
    nonce: String,
    signature: String,
}

fn verify_hmac(data: &str, received_sig: &str) -> bool {
    let mut mac = HmacSha256::new_from_slice(SECRET).expect("HMAC can take key of any size");
    mac.update(data.as_bytes());
    let result = mac.finalize();
    let code = result.into_bytes();
    // Constant-time comparison in real code; simplified here
    hex::encode(code) == received_sig
}

#[post("/transfer")]
async fn transfer(Json(payload): Json<SignedRequest>) -> String {
    let timestamp = payload.timestamp;
    let now = SystemTime::now()
        .duration_since(UNIX_EPOCH)
        .unwrap()
        .as_secs();
    // Reject if timestamp is too old (replay protection)
    if now.saturating_sub(timestamp) > 300 {
        return "Request expired".to_string();
    }
    // Construct the signed string exactly as the client did
    let string_to_verify = format!(
        "action:{}:timestamp:{}:nonce:{}",
        payload.action, payload.timestamp, payload.nonce
    );
    if !verify_hmac(&string_to_verify, &payload.signature) {
        return "Invalid signature".to_string();
    }
    // Additional anti-CSRF: ensure Origin/Referer or a same-site cookie is validated
    // Proceed with the action only after all checks
    format!("Executed action: {}", payload.action)
}

#[get("")]
async fn index() -> String {
    // Example of generating a signed link (server-side)
    let nonce = "unique-per-request-nonce";
    let timestamp = SystemTime::now()
        .duration_since(UNIX_EPOCH)
        .unwrap()
        .as_secs();
    let string_to_sign = format!(
        "action:transfer:timestamp:{}:nonce:{}",
        timestamp, nonce
    );
    let mut mac = HmacSha256::new_from_slice(SECRET).expect("HMAC can take key of any size");
    mac.update(string_to_sign.as_bytes());
    let signature = mac.finalize();
    let code = hex::encode(signature.into_bytes());
    format!(
        r#"<form action="/transfer" method="post">
            <input type="hidden" name="action" value="transfer" />
            <input type="hidden" name="timestamp" value="{}" />
            <input type="hidden" name="nonce" value="{}" />
            <input type="hidden" name="signature" value="{}" />
            <button type="submit">Transfer</button>
        </form>"#,
        timestamp, nonce, code
    )
}

#[rocket::main]
async fn main() {
    rocket::build()
        .mount("/", routes![index, transfer])
        .attach(SecurityHeaders)
        .launch()
        .await;
}

These examples show how to combine Hmac Signatures with anti-clickjacking headers and context-bound verification to reduce the risk of UI redress attacks. Security headers prevent embedding, while tightly scoped Hmac verification with timestamps and nonces ensures that even if a request is triggered inside a frame, it cannot be reused or executed without the correct context.