Clickjacking

Clickjacking Possible (OTG-CLIENT-009) 
 Clickjacking is a vulnerability that allows an attacker to trick users into clicking something they didn't intend to, potentially causing unauthorized actions on a website. The best way to prevent this in a Laravel project is by setting the X-Frame-Options HTTP header.

---

✅ Solution: Protect Laravel from Clickjacking

You need to configure the response headers to prevent clickjacking attacks.

1️⃣ Add X-Frame-Options in Middleware

Laravel provides a built-in middleware to prevent clickjacking. You just need to enable it.

Step 1: Open the Middleware file
Navigate to:
📂 app/Http/Middleware/TrustHosts.php (Laravel 7+)
📂 app/Http/Middleware/FrameGuard.php (Laravel 5.4 - 6)

If the file doesn't exist, create a new middleware:

php artisan make:middleware FrameGuard

Step 2: Add the following code to prevent clickjacking

namespace App\Http\Middleware;

use Closure;

class FrameGuard
{
    public function handle($request, Closure $next)
    {
        $response = $next($request);
        $response->headers->set('X-Frame-Options', 'SAMEORIGIN');
        return $response;
    }
}

✅ Explanation:

• "SAMEORIGIN" allows the page to be embedded only within the same site.
• You can also use "DENY" to completely block embedding.

Step 3: Register the Middleware
Open 📂 app/Http/Kernel.php and add this line under $middleware:

protected $middleware = [
    \App\Http\Middleware\FrameGuard::class,
];

---

2️⃣ Alternative: Configure X-Frame-Options in .htaccess

If you're using Apache as the web server, you can set the X-Frame-Options header in .htaccess.

📂 Open the .htaccess file in your Laravel public folder (public/.htaccess) and add:

<IfModule mod_headers.c>
    Header always set X-Frame-Options "SAMEORIGIN"
</IfModule>

If you're using Nginx, modify your server block:

add_header X-Frame-Options "SAMEORIGIN";

---

3️⃣ Verify If It’s Working

After making the changes, check if the header is present by:

1️⃣ Using Developer Tools in Browser

• Open your site in Chrome or Firefox.
• Right-click → Inspect → Network Tab.
• Reload the page and check the Response Headers.

2️⃣ Using Curl Command Run this in your terminal:

curl -I http://your-website.com

You should see:

X-Frame-Options: SAMEORIGIN

---

🚀 Final Summary

✅ Best Fix → Use Laravel Middleware (X-Frame-Options: SAMEORIGIN)
✅ Alternative → Set it in .htaccess for Apache or in nginx.conf
✅ Test It → Use browser dev tools or curl to verify

Now your Laravel app is protected against Clickjacking! 🔒 🚀
Let me know if you need further help. 😊