Clickjacking protection in Django - Mini Project: Build & Apply

Clickjacking Protection in Django

📖 Scenario: You are building a Django web application that needs protection against clickjacking attacks. Clickjacking tricks users into clicking hidden buttons or links by overlaying transparent frames. To keep your site safe, you will add clickjacking protection using Django's built-in features.

🎯 Goal: Learn how to enable clickjacking protection in a Django project by setting up middleware and using the X-Frame-Options header to prevent your pages from being embedded in frames on other sites.

📋 What You'll Learn

Create a Django settings variable to enable clickjacking protection middleware

Add the clickjacking protection middleware to the middleware list

Use the X_FRAME_OPTIONS setting to control frame options

Apply the @xframe_options_deny decorator to a view to deny framing

💡 Why This Matters

🌍 Real World

Clickjacking protection is essential for any website that handles user input or sensitive data. It prevents attackers from tricking users into clicking hidden elements.

💼 Career

Understanding and implementing security headers like X-Frame-Options is a key skill for web developers and security engineers working with Django or any web framework.

1

Add clickjacking protection middleware

In your Django settings.py file, add the middleware 'django.middleware.clickjacking.XFrameOptionsMiddleware' to the MIDDLEWARE list. This middleware helps protect your site from clickjacking by setting the X-Frame-Options header.

Django

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    # Add clickjacking protection middleware below
]

Need a hint?

Look for the MIDDLEWARE list in settings.py and add the clickjacking middleware as a string inside the list.

2

Set the X_FRAME_OPTIONS setting

In settings.py, add a variable called X_FRAME_OPTIONS and set it to the string 'DENY'. This tells browsers to deny any attempt to display your site inside a frame or iframe.

Django

MIDDLEWARE = [
    'django.middleware.security.SecurityMiddleware',
    'django.contrib.sessions.middleware.SessionMiddleware',
    'django.middleware.common.CommonMiddleware',
    'django.middleware.csrf.CsrfViewMiddleware',
    'django.contrib.auth.middleware.AuthenticationMiddleware',
    'django.contrib.messages.middleware.MessageMiddleware',
    'django.middleware.clickjacking.XFrameOptionsMiddleware',
]

# Set X_FRAME_OPTIONS to deny framing

Need a hint?

Define X_FRAME_OPTIONS exactly as shown to deny framing.

3

Import the decorator for clickjacking protection

In your Django app's views.py file, import the decorator xframe_options_deny from django.views.decorators.clickjacking. This decorator will help protect individual views from being framed.

Django

# Import xframe_options_deny decorator

Need a hint?

Use the exact import statement to bring in xframe_options_deny from the clickjacking decorators.

4

Apply the clickjacking protection decorator to a view

In views.py, apply the @xframe_options_deny decorator above a view function called home. This will prevent the home page from being displayed inside any frame or iframe.

Django

from django.views.decorators.clickjacking import xframe_options_deny

from django.http import HttpResponse

# Add the decorator to the home view

Need a hint?

Place @xframe_options_deny directly above the home function definition.