Clickjacking Prevention in Symfony: Best Practices

Clickjacking is a UI redress attack that tricks users into clicking on something different than what they perceive, potentially leading to sensitive actions without their consent. If you're building a Symfony web application, preventing Clickjacking is essential for user safety and application trustworthiness.

In this post, you'll learn:

• What Clickjacking is and how it works
• How to prevent Clickjacking in Symfony using best practices
• Real code examples to implement headers
• How to scan your site for Clickjacking using our free tool
• Where to get a professional penetration test for your app

🛡️ What Is Clickjacking?

Clickjacking, also known as UI redress, occurs when an attacker tricks a user into clicking on a malicious, hidden element on a website—like a button or link layered behind legitimate content. This can lead to unwanted actions like changing settings, liking content, or even transferring money.

Example Scenario:
A user thinks they’re clicking a “Play” button, but they’re actually clicking a hidden “Delete Account” button from a framed application.

🔐 Prevent Clickjacking in Symfony with Secure Headers

Symfony provides a clean and secure way to handle HTTP response headers. You can use the X-Frame-Options header to control whether your application can be embedded in an iframe.

✅ Method 1: Set Header Using Event Subscriber

Create an event subscriber to modify all outgoing responses.

// src/EventSubscriber/ClickjackingProtectionSubscriber.php
namespace App\EventSubscriber;

use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpKernel\Event\ResponseEvent;
use Symfony\Component\HttpKernel\KernelEvents;

class ClickjackingProtectionSubscriber implements EventSubscriberInterface
{
    public static function getSubscribedEvents()
    {
        return [
            KernelEvents::RESPONSE => 'onKernelResponse',
        ];
    }

    public function onKernelResponse(ResponseEvent $event)
    {
        $response = $event->getResponse();
        $response->headers->set('X-Frame-Options', 'DENY');
    }
}

Then, register this subscriber in your services.yaml:

# config/services.yaml
services:
    App\EventSubscriber\ClickjackingProtectionSubscriber:
        tags:
            - { name: kernel.event_subscriber }

✅ Method 2: Set Headers via .htaccess (If Using Apache)

<IfModule mod_headers.c>
    Header always set X-Frame-Options "DENY"
</IfModule>

Or, to allow same-origin only:

<IfModule mod_headers.c>
    Header always set X-Frame-Options "SAMEORIGIN"
</IfModule>

✅ Method 3: Content-Security-Policy Header

Modern browsers also respect Content-Security-Policy: frame-ancestors.

$response->headers->set('Content-Security-Policy', "frame-ancestors 'none'");

This provides broader and more modern control than X-Frame-Options.

🔍 Scan Your Symfony App for Clickjacking

Before going live, test your website for Clickjacking vulnerabilities using our Website Vulnerability Scanner.

📸 [Screenshot of the Free Website Vulnerability Scanner Homepage]

Screenshot of the free tools webpage where you can access security assessment tools.

Simply enter your website URL and get an instant security report to check Website Vulnerability including Clickjacking status.

📸 [Screenshot of Vulnerability Report with Clickjacking Result]

An Example of a vulnerability assessment report generated with our free tool, providing insights into possible vulnerabilities.

This tool checks your HTTP response headers and flags issues like missing X-Frame-Options or weak Content-Security-Policy.

🧪 Try-Yourself Symfony Example to Test Clickjacking

Create a test route that returns a basic view:

// src/Controller/TestController.php
namespace App\Controller;

use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\Routing\Annotation\Route;

class TestController extends AbstractController
{
    #[Route('/test-frame', name: 'test_frame')]
    public function testFrame(): Response
    {
        return $this->render('test/frame.html.twig');
    }
}

Then embed it in an iframe from another domain:

<!-- Malicious Site -->
<iframe src="https://your-symfony-app.com/test-frame" width="800" height="600"></iframe>

If your headers are properly set, the browser will block the iframe and prevent Clickjacking.

📚 Learn More Security Tips

Explore more Symfony and web app security tips on our official blog:
🔗 Pentest Testing Blog

🧰 Need Expert Help? Try Our Web App Penetration Testing Service

Preventing Clickjacking is just one part of securing your web application. For a comprehensive evaluation, get a professional penetration test.

Our team provides:

• Manual & automated vulnerability assessment
• Business logic flaw detection
• OWASP Top 10 compliance checks
• A detailed vulnerability report and mitigation steps

👉 Learn more:
🔗 Web App Penetration Testing Services

🔗 Summary

Clickjacking is an invisible yet dangerous threat. Protecting your Symfony app is as simple as setting the correct headers, running security checks, and regularly scanning your site. Don’t leave it to chance—scan your site now and fix vulnerabilities before attackers find them.

🔗 Try our tool: https://free.pentesttesting.com/
🔗 Read more on our blog: https://www.pentesttesting.com/blog/