Clickjacking in Spring Boot

Clickjacking attacks exploit the ability to embed a Spring Boot application within an iframe on a malicious site, tricking users into interacting with hidden elements. In Spring Boot applications, this vulnerability often appears in endpoints that return HTML content without proper frame-busting headers. For example, a Thymeleaf template rendering a form without X-Frame-Options headers can be loaded inside a zero-opacity iframe on an attacker's site. The attacker then overlays convincing UI elements on top, making users believe they're clicking a 'Download' button when they're actually submitting a CSRF token or transferring funds through a hidden banking endpoint.

Spring Boot's default configuration doesn't include X-Frame-Options headers, making this a common oversight. Applications using Spring Security 5.7+ have improved defaults, but many still expose endpoints that should never be framed. REST controllers returning JSON can also be vulnerable if they trigger state-changing operations without proper CSRF protection, and an attacker can use clickjacking to trick users into submitting malicious requests. The combination of Spring Boot's auto-configuration convenience and developers' focus on functionality over security often leaves these headers missing in production deployments.

Detecting clickjacking in Spring Boot applications requires examining both the HTTP response headers and the application's configuration. Using middleBrick's API security scanner, you can identify missing X-Frame-Options or Content-Security-Policy frame-ancestors directives across all endpoints. The scanner tests each URL by attempting to frame it and checking for the presence of anti-framing headers. For Spring Boot specifically, middleBrick analyzes your application's security configuration, including any custom WebSecurityConfigurerAdapter implementations that might override default security settings.

# Scan your Spring Boot API with middleBrick
middlebrick scan https://yourapp.com/api/user/profile

The scanner also examines OpenAPI specifications if provided, identifying endpoints that return HTML or have state-changing operations that could be exploited through clickjacking. middleBrick's LLM security module can detect if your Spring Boot application includes AI endpoints that might be vulnerable to prompt injection when framed. For comprehensive testing, middleBrick's continuous monitoring feature (Pro plan) can periodically rescan your endpoints, alerting you if new routes are added without proper anti-framing protections.

Spring Boot provides several approaches to prevent clickjacking, with the most straightforward being the X-Frame-Options header. For Spring Boot applications using Spring Security, add this configuration to your WebSecurityConfigurerAdapter:

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.headers().frameOptions().deny();
        
        http.authorizeRequests()
            .antMatchers("/").permitAll()
            .anyRequest().authenticated();
    }
}

For applications not using Spring Security, you can add a filter that sets the X-Frame-Options header globally:

@Component
public class XFrameOptionsFilter implements Filter {
    
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, 
                         FilterChain chain) throws IOException, ServletException {
        if (response instanceof HttpServletResponse) {
            HttpServletResponse httpResp = (HttpServletResponse) response;
            httpResp.addHeader("X-Frame-Options", "DENY");
        }
        chain.doFilter(request, response);
    }
}

The Content-Security-Policy header provides more granular control and is recommended for modern Spring Boot applications:

@Configuration
public class SecurityConfig {
    
    @Bean
    public FilterRegistrationBean<XFrameOptionsFilter> xFrameOptionsFilter() {
        FilterRegistrationBean<XFrameOptionsFilter> registrationBean = 
            new FilterRegistrationBean<>();
        registrationBean.setFilter(new XFrameOptionsFilter());
        registrationBean.addUrlPatterns("/api/*");
        return registrationBean;
    }
}

For Spring Boot applications using Thymeleaf or other template engines, ensure your controller methods include the appropriate headers:

@Controller
public class UserController {
    
    @GetMapping("/profile")
    public String userProfile(Model model, HttpServletResponse response) {
        response.addHeader("X-Frame-Options", "DENY");
        response.addHeader("Content-Security-Policy", "frame-ancestors 'none'");
        // ... rest of method
        return "profile";
    }
}