Our security team flagged a medium severity security concern with Auth0 login, during a penetration test on a regular web app secured with Auth0. The concern is about the potential for click-jacking . Whilst I’ve already asked about CSP as one defense , it is also suggested to add this header in your …

@davidread Did you check Clickjacking Protection for Universal Login Change ? Instead of adding these headers for all customers, therefore, Auth0 has added an opt-in for these headers which we strongly recommend you to enable. You can do this by navigating to Tenant Settings > Advanced Settings , s…

Clickjacking via iframes

Get Help

dan.woda Closed August 29, 2019, 9:03am 7

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Content Security Policy Get Help security	7	6179	August 20, 2019
Clickjacking Protection in Classic Universal Login! Announcements auth0 , login , universal-login , click-jacking	2	8600	September 3, 2019
Prevent iframe clickjacking (using X-Frame-Options header) Get Help security	4	4166	September 2, 2019
Click-jacking Risks Get Help auth0 , login , click-jacking	0	1864	June 6, 2022
X-Frame-Options: SAMEORIGIN Get Help auth0 , login	5	5682	December 21, 2019

Clickjacking via iframes

Related topics