Redress attacks manipulate how users visualize and interact with web elements, often by overlaying malicious content over legitimate interfaces. These attacks can include clickjacking and UI redressing. Prevention involves proper frame busting, security headers like X-Frame-Options, and careful consideration of UI design and implementation.
Redress attacks, often called UI redressing, manipulate what a user sees so their interactions are misdirected to targets they did not intend. Clickjacking is the best-known member of the family, but the category is broader: cursorjacking desynchronizes the visible pointer from the real one, likejacking harvests social actions, and drag-and-drop or keystroke redressing steer input into hidden fields. The common mechanism is a mismatch between the interface the user perceives and the interface actually receiving their input, typically achieved by overlaying, framing, or making legitimate controls transparent. The user acts in good faith on a real, authenticated session while their clicks, drags, or keystrokes are quietly captured by attacker-controlled placement.
Redress attacks succeed because they exploit trust in the visible interface rather than any code flaw, so they slip past input validation, CSP script controls, and even multi-factor authentication, the user is genuinely logged in and genuinely clicking. The damage mirrors whatever action the target page exposes in a click or two: authorizing payments, granting OAuth permissions, changing account settings, or leaking data into hidden inputs. Because nothing is injected into the target application and the user cooperates unknowingly, these attacks are hard to spot from server logs and easy to disguise as ordinary game-like or incentive prompts that lure the victim into precise clicks.
The primary defense is controlling how your pages can be embedded: set Content-Security-Policy frame-ancestors and X-Frame-Options so sensitive pages cannot be framed by third parties, the same headers that stop clickjacking. Add confirmation steps for high-impact actions, avoid one-click irreversible operations, and design UIs that resist transparent overlays. Keep framing headers present on every sensitive route. Since these protections live in your secure headers and can be undermined by a compromised or rogue third-party script, cside's runtime monitoring helps by detecting when framing headers are altered or stripped, keeping the anti-redress controls effective in production.
Clickjacking is one type of redress attack, the most common one, focused on hijacked clicks. UI redressing is the umbrella term and also covers cursorjacking, likejacking, and drag-and-drop or keystroke redressing. They share a mechanism: the interface the user perceives differs from the one actually receiving their input.
Usually not. MFA verifies who the user is at login, but a redress attack abuses an already-authenticated session by tricking the user into clicking or dragging within it. The defense is framing controls and confirmation on sensitive actions, not stronger authentication.
We answer client-side security questions every day. Bring yours.