Security headers and clickjacking
Missing frame protection, CSP, HSTS, Referrer-Policy, cookie flags, HTTP downgrade paths and e-mail spoofing protection (SPF/DMARC).
Check method
Missing frame protection, CSP, HSTS, Referrer-Policy, cookie flags, HTTP downgrade paths and e-mail spoofing protection (SPF/DMARC).
Possible evidence type
Live observation when the check is compatible and authorized. This description does not mean your platform has been tested.
Access and limitations
Website address. Actual results and checks not run appear in your report. A check with no finding does not guarantee the absence of risk.
Concrete scenario
A sensitive application can be framed by an unrelated website, or a protective response header is absent.
What to inspect
Check actual deployed headers and whether the affected page performs sensitive actions. Absence of a header does not prove every attack is feasible.
Remediation approach
Apply an appropriate CSP frame-ancestors policy and relevant response protections; test normal embedded integrations before rollout.
Follow the request across the trust boundary
A browser can send values that the server did not intend: an object identifier, a destination URL, a header or a modified payload. The important question is where the application stops trusting that value and checks permissions, format and context. A visible route alone does not establish a vulnerability; the response and the relevant protection must be examined together.
- Identify the affected endpoint and the data or action it exposes.
- Determine whether the observation was made as an anonymous visitor or under a specific authorized identity.
- Compare the observed behavior with the expected server-side restriction; do not treat a status code alone as proof of access.
Plan and validate remediation
Keep the protection on the server, as close to the protected resource as possible. Browser-only checks, hidden buttons and client-side role flags do not prevent direct requests. Configuration controls such as CORS or security headers solve different problems from authentication and authorization.
- Reproduce with the report’s exact path and context in an authorized environment.
- Apply the narrowest server-side change that closes the demonstrated gap.
- Check the blocked scenario and an allowed scenario, then review caches, alternate routes and related endpoints.
References
OWASP A05
Sources and further reading
These publications describe related practices and standards. They do not certify your platform or imply that Hackaiz executes every documented method.