Collected research

A Tale of Two Headers: A Formal Analysis of Inconsistent Click-Jacking Protection on the Web

Stefano Calzavara, Sebastian Roth, Alvise Rabitti, Michael Backes and Ben Stock · usenix.org

Framing control is split between X-Frame-Options and CSP frame-ancestors, which browsers implement differently. A formal model and an automated policy analyser found ten percent of distinct framing policies in the wild inconsistent, usually leaving at least one browser with no clickjacking protection, and a server-side proxy is proposed to retrofit a consistent policy.

Record

Researcher

Stefano Calzavara, Sebastian Roth, Alvise Rabitti, Michael Backes and Ben Stock

Published by

usenix.org

Topic

HTTP

In the archive

• Collected in the 2020 research round

Related sources

• USENIX Security '20 - A Tale of Two Headers: A Formal Analysis of Inconsistent Click-Jacking...

Tags

• clickjacking
• ui-redress
• csp
• iframe
• formal-analysis
• measurement-study
• large-scale-scan
• mitigation
• defence
• owasp-a04-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Stefano Calzavara, Sebastian Roth, Alvise Rabitti, Michael Backes and Ben Stock, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 19 August 2026.