What is 'clickjacking' and what two HTTP response headers protect against it?

• A.Clickjacking is prevented by enforcing HTTPS and using HSTS headers
• B.Clickjacking only affects POST form submissions; GET-based actions are not vulnerable
• C.Clickjacking is prevented by the SameSite=Strict cookie attribute alone
• D.Clickjacking embeds the target site in a transparent iframe and tricks users into clicking on it (e.g., 'claim prize' button actually triggers account deletion on the target site). Defenses: (1) X-Frame-Options: DENY (prevents framing entirely) or SAMEORIGIN (allows only same-origin framing); (2) Content-Security-Policy: frame-ancestors 'none' (CSP equivalent, more flexible - allows specific origins). frame-ancestors in CSP supersedes X-Frame-Options in supporting browsers. Both are still deployed for backward compatibility