What is 'clickjacking' and what two HTTP response headers protect against it?

• A.Clickjacking embeds a malicious iframe inside the target site and tricks users into typing in it (e.g., a fake 'verify password' form actually sends credentials to the attacker). Defenses: (1) X-Frame-Options: DENY (prevents framing entirely) or SAMEORIGIN (allows only same-origin framing); (2) Content-Security-Policy: frame-src 'none' (CSP equivalent, more flexible - allows specific origins); frame-src in CSP supersedes X-Frame-Options in supporting browsers. Both are still deployed for backward compatibility with older proxies
• B.Clickjacking replays the victim's session in a transparent iframe and tricks users into clicking on it (e.g., 'claim prize' button actually triggers a login on the attacker site). Defenses: (1) X-Frame-Options: ALLOW-ALL (permits framing from any origin) or NONE (blocks cookies); (2) Content-Security-Policy: script-src 'none' (CSP equivalent, less flexible - blocks inline handlers); script-src in CSP supersedes X-Frame-Options in supporting browsers. Both are deprecated
• C.Clickjacking embeds the target site in a transparent iframe and tricks users into clicking on it (e.g., 'claim prize' button actually triggers account deletion on the target site). Defenses: (1) X-Frame-Options: DENY (prevents framing entirely) or SAMEORIGIN (allows only same-origin framing); (2) Content-Security-Policy: frame-ancestors 'none' (CSP equivalent, more flexible - allows specific origins). frame-ancestors in CSP supersedes X-Frame-Options in supporting browsers. Both are still deployed for backward compatibility