Clickjacking in Sinatra with Hmac Signatures

Clickjacking is a client-side attack that tricks a user into interacting with a hidden or disguised UI element inside an embedded page. In Sinatra applications that rely on Hmac Signatures for request validation, a common misconfiguration can leave interfaces vulnerable even when signatures are used.

Hmac Signatures typically protect the integrity of requests by verifying that parameters (including action or route information) have not been tampered with. However, if the application embeds frames or if UI-rendering endpoints do not enforce a frame-ancestors policy, an attacker can host a malicious page that loads the Sinatra endpoint inside an invisible iframe. When the user is already authenticated (e.g., via session cookie), the browser will include credentials automatically, and the Hmac Signature—computed from parameters the attacker may partially control or predict—may still validate successfully if the signature logic does not explicitly bind the request to the intended origin or embed context.

Consider a Sinatra route that performs a money transfer using a GET request with query parameters and an Hmac Signature derived from account_id, amount, and a timestamp. An attacker can craft a page with an invisible form or iframe that submits the same route with malicious parameters. If the server uses the same Hmac key for signing without including a nonce or origin binding, the signature may remain valid, and the request will be processed. This occurs because the signature does not inherently protect against UI redressing; it only ensures the parameters were not modified after signing. The vulnerability is not in the cryptographic correctness of the Hmac but in the lack of anti-framing controls and context binding.

Additionally, if the Sinatra app exposes an API endpoint that returns sensitive UI fragments or JSON intended for embedding elsewhere, and that endpoint does not validate the Referer or Origin headers, an attacker can use the response within a framed context. Even with Hmac Signatures on state-changing requests, the read endpoints might leak information that aids phishing or further social engineering. The presence of Hmac Signatures can give a false sense of security if developers assume that signed requests are immune to injection into malicious pages.

To illustrate, a vulnerable Sinatra route might look like this, where the signature is computed but no anti-framing headers are set:

require 'sinatra'
require 'openssl'
require 'base64'

configure do
  set :hmac_key, 'shared-secret-key-change-in-production'
end

def generate_hmac(params)
  data = params.sort.map { |k, v| "#{k}=#{v}" }.join('&')
  OpenSSL::HMAC.hexdigest('sha256', settings.hmac_key, data)
end

get '/transfer' do
  account_id = params['account_id']
  amount = params['amount']
  timestamp = Time.now.to_i.to_s
  signature = generate_hmac('account_id' => account_id, 'amount' => amount, 'timestamp' => timestamp)
  # Vulnerable: no X-Frame-Options, no Content-Security-Policy frame-ancestors
  "Transfer: account=#{account_id}, amount=#{amount}, ts=#{timestamp}, sig=#{signature}"
end

Remediation focuses on binding the Hmac context to prevent its misuse across origins and ensuring that the application rejects requests that could be injected into a malicious frame. The first step is to include origin or referer validation as part of the signed parameters so that a signature computed for one origin is invalid when presented in another context. This prevents an attacker from reusing a valid signature in their own framed page.

Second, Sinatra applications should enforce strict framing policies via response headers. This does not alter the Hmac computation but ensures that even if a signature were somehow valid, the page cannot be embedded in an attacker-controlled frame.

Third, include a nonce or timestamp with strict replay checks to ensure that each signed request is unique and time-bound. This binds the signature to a specific execution window, reducing the window for potential abuse if a signature were leaked or if an attacker attempts to reuse parameters.

The following example demonstrates a hardened Sinatra route that incorporates origin binding, anti-framing headers, and timestamp-based nonce validation:

require 'sinatra'
require 'openssl'
require 'base64'

configure do
  set :hmac_key, 'shared-secret-key-change-in-production'
  set :allowed_origin, 'https://your-app.com'
end

def generate_hmac(params)
  data = params.sort.map { |k, v| "#{k}=#{v}" }.join('&')
  OpenSSL::HMAC.hexdigest('sha256', settings.hmac_key, data)
end

before do
  # Set anti-framing headers
  headers 'X-Frame-Options' => 'DENY',
          'Content-Security-Policy' => "frame-ancestors 'none'"
end

post '/secure-transfer' do
  content_type :json
  origin = request.env['HTTP_ORIGIN']
  referer = request.env['HTTP_REFERER']
  timestamp = params['timestamp']
  account_id = params['account_id']
  amount = params['amount']

  # Validate request origin to bind Hmac context
  unless origin == settings.allowed_origin || referer&.start_with?(settings.allowed_origin.to_s)
    status 403
    return { error: 'Invalid request origin' }.to_json
  end

  # Reject requests older than 2 minutes to prevent replay
  if (Time.now.to_i - timestamp.to_i).abs > 120
    status 400
    return { error: 'Request expired' }.to_json
  end

  expected_signature = generate_hmac('account_id' => account_id, 'amount' => amount, 'timestamp' => timestamp, 'origin' => origin)
  provided_signature = params['signature']

  unless Rack::Utils.secure_compare(expected_signature, provided_signature)
    status 401
    return { error: 'Invalid signature' }.to_json
  end

  # Proceed with transfer logic
  { status: 'ok', message: "Transferred #{amount} from #{account_id}" }.to_json
end

In this remediation, the Hmac signature includes the origin parameter, ensuring that a signature generated for one origin will not validate when the request originates from a different context. The server validates the Origin and Referer headers against a strict allowlist before processing the signature. Anti-framing headers prevent the page from being embedded, and a short-lived timestamp with replay protection binds the request to a narrow time window. These changes make clickjacking impractical even if an attacker can trick a user into making a request, because the origin binding will fail or the signature will be tied to a stale timestamp.