A recent security assessment revealed a web application may be vulnerable to clickjacking.
According to the application developers, a fix may be months away.
Which of the following should a security engineer configure on the web server to help mitigate the issue?
Click on the arrows to vote for the correct answer
A. B. C. D.C.
The correct answer to this question is C. X-Frame-Options header.
Explanation:
Clickjacking is a type of attack that tricks users into clicking on a button or link that they didn't intend to click on, usually by overlaying a fake button or link on top of a legitimate one. This can be done by embedding the targeted website in an iframe on a malicious website, so that the user interacts with the malicious website without realizing it.
To mitigate the risk of clickjacking, one effective measure is to configure the web server to include the X-Frame-Options header in HTTP responses. This header tells the browser whether or not to allow the website to be displayed in an iframe. There are three possible values for this header:
By setting the X-Frame-Options header to DENY or SAMEORIGIN, the web server can prevent clickjacking attacks that rely on iframes. This is a simple and effective way to protect the web application, and it does not require any changes to the application code itself.
The other answer choices are not directly related to mitigating the risk of clickjacking:
A. File upload size limits: This is a measure to prevent the uploading of excessively large files to the web server, which can cause denial of service attacks or fill up the server's storage capacity. While this can be a useful security measure in general, it does not directly address the risk of clickjacking.
B. HttpOnly cookie field: This is a flag that can be set on an HTTP cookie to prevent client-side scripts from accessing it. This can help protect against cross-site scripting (XSS) attacks, but it does not directly address the risk of clickjacking.
D. Input validation: This is the process of checking user input to ensure that it meets certain criteria, such as length, format, or content. Input validation is a critical security measure that can help prevent a variety of attacks, including SQL injection, buffer overflow, and command injection. However, it does not directly address the risk of clickjacking.