Flexible and secure clickjacking protection mechanism
AssigneeSap SE
InventorsSebastian Lekies, Martin Johns
Life of this patent
Estimating the term…
Abstract
Methods, systems, and computer-readable storage media for preventing a clickjacking attack on a web page. Implementations include inhibiting rendering of content of the web page, receiving a message from an embedding web page, the embedding web page having called the web page, the message including metadata, and determining whether the embedding web page is trusted based on the metadata, wherein rendering of content of the web page remains inhibited if the embedding web page is untrusted, and rendering of content of the web page is executed if the embedding web page is trusted.
Claims16
A computer-implemented method for preventing a clickjacking attack on a web page, the method being executed using one or more processors and comprising:
- receiving a request for the web page;
- and
- in response to the request, providing a web page document underlying the web page, the web page document comprising instructions that are executed in response to loading of the web page for:
- inhibiting rendering of content of the web page;
- receiving a message from an embedding web page, the embedding web page having called the web page, the message comprising an origin of the embedding web page and
- determining whether the embedding web page is trusted based on an authentication of the origin, wherein rendering of content of the web page remains inhibited if the embedding web page is untrusted, and rendering of content of the web page is executed if the embedding web page is trusted.
A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for preventing a clickjacking attack on a web page, the operations comprising:
- receiving a request for the web page;
- and
- in response to the request, providing a web page document underlying the web page, the web page document comprising instructions that are executed in response to loading of the web page for:
- inhibiting rendering of content of the web page;
- receiving a message from an embedding web page, the embedding web page having called the web page, the message comprising an origin of the embedding web page;
- and
- determining whether the embedding web page is trusted based on an authentication of the origin, wherein rendering of content of the web page remains inhibited if the embedding web page is untrusted, and rendering of content of the web page is executed if the embedding web page is trusted.
A system, comprising:
- a computing device that executes a web browser, the web browser being operable to execute instructions provided in web page documents for preventing a clickjacking attack on a web page, the operations comprising:
- sending a request for the web page;
- and
- receiving a web page document underlying the web page, the web page document comprising instructions that are executed by the web browser in response to loading of the web page for:
- inhibiting rendering of content of the web page;
- receiving a message from an embedding web page, the embedding web page having called the web page, the message comprising an origin of the embedding web page;
- and
- determining whether the embedding web page is trusted based on an authentication of the origin, wherein rendering of content of the web page remains inhibited if the embedding web page is untrusted, and rendering of content of the web page is executed if the embedding web page is trusted.
Dependencies are inferred from the claim text.