Clickjacking prevention

A computer-implemented method for preventing clickjacking on a user device, the method comprising:

• receiving an embedded webpage called by an embedding webpage rendered on the user device, the embedded webpage containing clickjacking prevention code;
• and
• executing the clickjacking prevention code on the user device to perform operations that include:
• preventing content of the embedded webpage from being rendered;
• sending a message containing a secret to a server of a known domain;
• after sending the message containing the secret to the server, receiving a message from the embedding webpage that called the embedded webpage;
• determining whether the message from the embedding webpage includes the secret, the message from the embedding webpage including the secret when the embedding webpage is legitimate and receives the secret from the server after the secret is sent to the server from the user device;
• when the message from the embedding webpage includes the secret, allowing the content of the embedded webpage to be rendered;
• and
• when the message from the embedding webpage does not include the secret, continuing to prevent the content of the embedded webpage from being rendered.

A computer system comprising:

• one or more hardware processors;
• and
• one or more computer storage media storing computer-useable instructions that, when used by the one or more processors, cause the one or more processors to:
• receive a request for an embedded webpage from a user device, the request having been generated in response to an embedding webpage calling the embedded webpage;
• and
• providing the embedded webpage in response to the request, the embedded webpage including clickjacking prevention code that when executed on the client device causes the client device to perform operations that include:
• preventing content of the embedded webpage from being rendered;
• sending a message containing a secret to a server of a known domain;
• after sending the message containing the secret to the server, receiving a message from the embedding webpage that called the embedded webpage;
• determining whether the message from the embedding webpage includes the secret, the message from the embedding webpage including the secret when the embedding webpage is legitimate and receives the secret from the server after the secret is sent to the server from the user device;
• when the message from the embedding webpage includes the secret, allowing the content of the embedded webpage to be rendered;
• and
• when the message from the embedding webpage does not include the secret, continuing to prevent the content of the embedded webpage from being rendered.