10.13. 点击劫持(10.13. Clickjacking)

10.13. 点击劫持

在点击劫持攻击中，攻击者注册一个合法客户端然后构造一个恶意站点，在一个透明的覆盖在一组虚假按钮上面的嵌入框架中加载授权服务器的授权端点Web页面，这些按钮被精心构造恰好放置在授权页面上的重要按钮下方。当最终用户点击了一个误导的可见的按钮时，最终用户实际上点击了授权页面上一个不可见的按钮（例如“授权”按钮）。 这允许攻击者欺骗资源所有者许可它的客户端最终用户不知晓的访问权限。

为了防止这种形式的攻击，在请求最终用户授权时本机应用程序应该使用外部浏览器而非应用程序中嵌入的浏览器。 对于大多数较新的浏览器，避免嵌入框架可以由授权服务器使用（非标准的）“x-frame-options”标头实施。 该标头可以有两个值，“deny”和“sameorigin”，它将阻止任何框架，或按不同来源的站点分别构造框架。 对于较旧的浏览器，JavaScript框架破坏技术可以使用，但可能不会在所有的浏览器中生效。

 

10.13. Clickjacking

   In a clickjacking attack, an attacker registers a legitimate client
   and then constructs a malicious site in which it loads the
   authorization server's authorization endpoint web page in a
   transparent iframe overlaid on top of a set of dummy buttons, which
   are carefully constructed to be placed directly under important
   buttons on the authorization page.  When an end-user clicks a
   misleading visible button, the end-user is actually clicking an
   invisible button on the authorization page (such as an "Authorize"
   button).  This allows an attacker to trick a resource owner into
   granting its client access without the end-user's knowledge.

   To prevent this form of attack, native applications SHOULD use
   external browsers instead of embedding browsers within the
   application when requesting end-user authorization.  For most newer
   browsers, avoidance of iframes can be enforced by the authorization
   server using the (non-standard) "x-frame-options" header.  This
   header can have two values, "deny" and "sameorigin", which will block
   any framing, or framing by sites with a different origin,
   respectively.  For older browsers, JavaScript frame-busting
   techniques can be used but may not be effective in all browsers.