Frank DENIS random thoughts.

Don't forget that clickjacking is still with us

Yes, the issue is old, and yes, it has been widely disclosed and discussed everywhere.

So, is clickjacking a threat of past?

Unfortunately not. Clickjacking is still a real issue until everyone upgrades to Flash 10 (and until a variant is found).

Although it’s only a partial barrier against clickjacking, something that any web developper should do on every web site if to check whether the site has been loaded as a frame (or iframe).

Really. As a bonus, it will defeat almost every web-based anonymous proxy, and it might prevent exploitation of cross-frame leaks.

Is there any downside? Probably none. It’s something I’m doing for years (was to bugger people surfing through anonymous proxies) without any issue.

How to do it? Just add some lines of javascript that checks whether window.parent.location.href matches your domain. If it doesn’t, set window.parent.location to window.location.href and you are done.