Clickjacking in Spring Boot with Cockroachdb

Clickjacking is a client-side UI redress attack where an attacker tricks a user into interacting with a transparent or hidden element inside an embedded frame. In a Spring Boot application using Cockroachdb as the backend datastore, the vulnerability arises not from Cockroachdb itself, but from missing HTTP response headers and insecure frame handling in the web layer. When a Spring Boot app serves HTML pages that are intended to be top-level views but are also served with an absent or misconfigured X-Frame-Options or Content-Security-Policy (CSP), an attacker can embed sensitive endpoints (such as those that perform database writes via Cockroachdb) inside iframes.

If the application relies on session-based authentication and does not enforce anti-CSRF tokens or SameSite cookies, a user logged into the Spring Boot app may inadvertently issue state-changing requests to the Cockroachdb-backed service when interacting with the malicious page. Cockroachdb does not introduce clickjacking risk, but if the application exposes data-modifying endpoints without proper UI-level protections, the database operations can be triggered unintentionally through forged UI actions. For example, an endpoint like /transfer that accepts POST requests to update account balances stored in Cockroachdb could be invoked via a crafted iframe without the user’s consent.

Another contributing factor is the use of permissive framing rules in development or legacy views. If a Thymeleaf or JSP page is rendered without explicit CSP frame-ancestors directives, and the backend routes rely only on referer checks (which can be omitted), the attack surface expands. Since Cockroachdb often serves as a distributed SQL backend for multi-region deployments, the exposed endpoints may be reachable from different origins, increasing the likelihood of successful clickjacking when defenses are inconsistent across services.

Remediation focuses on enforcing UI-level protections and ensuring that the Spring Boot application does not allow unintended framing of sensitive pages. Even though Cockroachdb is a database and does not manage HTTP headers, the application layer must ensure that responses including data from Cockroachdb are protected. Below are concrete Spring Boot configurations and code examples that mitigate clickjacking.

1. Enforce CSP frame-ancestors and X-Frame-Options

Configure HTTP response headers to prevent embedding. In a Spring Boot application, you can use a WebMvcConfigurer to add headers for all responses or apply them selectively to controller methods that render views interacting with Cockroachdb.

@Configuration
public class SecurityConfig implements WebMvcConfigurer {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .headers(headers -> headers
                .frameOptions(frameOptions -> frameOptions.disable()) // Disable legacy X-Frame-Options if using CSP
                .contentSecurityPolicy(csp -> csp
                    .policyDirectives("default-src 'self'; frame-ancestors 'none'")
                )
            );
        return http.build();
    }
}

The CSP directive frame-ancestors 'none' ensures that no frame can embed the page, effectively neutralizing clickjacking attempts. For pages that must be embedded (e.g., dashboards), explicitly allow trusted origins using frame-ancestors https://trusted.example.com.

2. Apply per-controller protections for Cockroachdb-driven endpoints

If certain views must be embeddable within the same application, restrict framing at the controller level and ensure that any state-changing operations require explicit CSRF tokens and SameSite cookies. Below is an example of a controller that interacts with Cockroachdb via Spring Data JPA and enforces strict CSP headers for its responses.

@RestController
@RequestMapping("/api/accounts")
public class AccountController {

    private final AccountRepository accountRepository;

    public AccountController(AccountRepository accountRepository) {
        this.accountRepository = accountRepository;
    }

    @PostMapping("/transfer")
    public ResponseEntity transfer(@RequestBody TransferRequest request,
                                           @RequestHeader("Origin") String origin,
                                           HttpServletResponse response) {
        // Validate origin and apply business logic that updates Cockroachdb
        accountRepository.transfer(request.from(), request.to(), request.amount());
        response.setHeader("Content-Security-Policy", "frame-ancestors 'self'");
        return ResponseEntity.ok("Transfer executed");
    }

    record TransferRequest(String from, String to, BigDecimal amount) {}
}

In this example, the endpoint explicitly sets a CSP header for the response, ensuring that even if the page is served in a broader context, the specific action is protected by frame restrictions. Additionally, ensure that your Spring Security configuration includes CSRF protection and that cookies serving session identifiers have the SameSite=Strict or Lax attribute.

3. Database and connection considerations with Cockroachdb

While Cockroachdb does not directly influence clickjacking, ensure that your data layer does not expose sensitive operations via GET endpoints, as these are more easily triggered via iframes. Use POST, PUT, or DELETE methods for mutations and validate the Origin header where necessary. Below is a repository example that aligns with secure practices when interacting with Cockroachdb.

@Repository
public class AccountRepository {

    private final JdbcTemplate jdbcTemplate;

    public AccountRepository(DataSource dataSource) {
        this.jdbcTemplate = new JdbcTemplate(dataSource);
    }

    public void transfer(String from, String to, BigDecimal amount) {
        // Use parameterized queries to prevent SQL injection
        jdbcTemplate.update(
            "UPDATE accounts SET balance = balance - ? WHERE id = ?",
            amount, from
        );
        jdbcTemplate.update(
            "UPDATE accounts SET balance = balance + ? WHERE id = ?",
            amount, to
        );
    }
}

By combining secure HTTP headers, careful controller design, and safe database access patterns, you mitigate clickjacking risks in a Spring Boot application backed by Cockroachdb.