Secure Apache from Clickjacking

In this post, I will explain an important Apache2 configuration, this configuration is used to stop clickjacking. I got to know about clickjacking when I was working with a security checklist in AEM.

Q1. What is clickjacking?
Clickjacking, also known as a “UI redress attack”, is when an attacker uses multiple transparent or opaque layers to trick a user into clicking on a button or link to another page when they were intending to click on the top-level page. Thus, the attacker is “hijacking” clicks meant for their page and routing them to another page, most likely owned by another application, domain, or both. If it is still not clear to you then I am attaching a video URL that will explain it in a much better way.

Q2. How to stop clickjacking in the AEM using Apache2 Server?
There is a header configuration named as X-Frame-Options, using this configuration, you can stop the clickjacking.

Q3. What is the syntax of this configuration?
Header set X-Frame-Options: “sameorigin”

Q4. Where do we find this configuration?
In Apache2.4 you have security.conf file in the conf-available directory. In this file, search for X-Frame-Options, it is already present there but commented by default. Now you have two options.

this setting and restart your Apache2 server.
Copy and paste this setting inApache2.conf, uncomment it and restart your Apache server.

In my case, I copied and pasted this setting in apche2.conf file uncommented it and restarted my Apche2 server.

Q5. Apache Server is throwing an error when restarting after this configuration?
It may be possible that you will get an error at the time of starting the Apache2 server, after adding this configuration, the reason is, this configuration requires mod_headers.so module enabled, which is by default disabled. To enable the module and your Apache server will start running successfully.

Q6. How to enable Headers.mod in Apache2 server?
For enabling this module you have a header.load file present in mods-available directory in your Apache2 server. In my case, it is present at /etc/apche2/mods-available. Just do one thing, create a softlink in your mods-enabled folder. If you are an Ubuntu user execute this command

ln –s /etc/apache2/mods–available/header.load /etc/apache2/mods–enabled/headers.load

Now you will see this soft link in your mods-enabled folder. Restart your Apache2 Server.

Q7. How to check whether it’s working or not?
After restarting your Apache2 server, just hit a noncached page via Apache2 Server. Open debugger and check the response header. You will see the X-Frame-Options header field, as shown below

If you get this option on your page it means your configuration is working.