Clickjacking (UI redress)

When it applies

A sensitive, state-changing page can be embedded in an <iframe> on an attacker site, and the action needs only clicks (no CSRF token / re-auth). The attacker overlays their own UI so the victim clicks the framed action unknowingly.

Why it works

Without X-Frame-Options: DENY/SAMEORIGIN or CSP frame-ancestors, the browser lets any site frame the page. Making the frame transparent and positioning it under a decoy button turns the victim's clicks into actions on the target in their authenticated session.