What is clickjacking, and how does a server prevent it?

Clickjacking is an attack where another site loads your page inside a hidden frame and tricks the user into clicking it. The attacker puts your site in an invisible iframe on their own page. A logged-in user thinks they are clicking the attacker's page. In fact, they click buttons on your page that they can't see, such as "confirm transfer" or "delete account".

The defence is to tell browsers not to let other sites put your pages in a frame:

• The modern control is the CSP (Content Security Policy) directive frame-ancestors 'none'.
• Use frame-ancestors 'self' instead if your own pages frame each other.
• Also send X-Frame-Options: DENY or SAMEORIGIN for older browsers.

Helmet (an Express security-headers library) does this by default. It sends X-Frame-Options: SAMEORIGIN and a CSP that includes frame-ancestors 'self'.

Some pages must be embeddable by other sites. For those, list the allowed parent origins in frame-ancestors. Also put sensitive actions behind a confirmation step.