FrontendHaltSecurity·Intermediate·Conceptual·1 min read
How do you defend against clickjacking?
Short interview answer
Prevent untrusted sites from framing sensitive pages with CSP frame-ancestors and, for legacy coverage, X-Frame-Options. For intended embeds, allowlist exact ancestors and design high-risk confirmations so UI redressing cannot silently trigger them.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.