Flexible and secure clickjacking protection mechanism

1. A computer-implemented method for preventing a clickjacking attack on a web page, the method being executed using one or more processors and comprising:

receiving a request for the web page; and

in response to the request, providing a web page document underlying the web page, the web page document comprising instructions that are executed in response to loading of the web page for:

inhibiting rendering of content of the web page;

receiving a message from an embedding web page, the embedding web page having called the web page, the message comprising an origin of the embedding web page and

determining whether the embedding web page is trusted based on an authentication of the origin, wherein rendering of content of the web page remains inhibited if the embedding web page is untrusted, and rendering of content of the web page is executed if the embedding web page is trusted.

2. The method of claim 1 , wherein the authentication of the origin comprises detection of untrusted viewpoint constellations of the embedding web page.

3. The method of claim 1 , wherein determining whether the embedding web page is trusted comprises comparing the origin to one or more trusted origins.

4. The method of claim 1 , wherein determining whether the embedding web page is trusted comprises comparing the origin to one or more untrusted origins.

5. The method of claim 1 , wherein the origin comprises a domain of the embedding web page.

6. The method of claim 1 , wherein the message comprises a PostMessage.

7. The method of claim 1 , further comprising:

registering a message handler; and

sending a ready message.

8. The method of claim 7 , wherein the message comprises a response to the ready message, and determining whether the embedding web page is trusted is performed in response to receiving the message.

9. The method of claim 1 , wherein receiving a message from an embedding web page and determining whether the embedding web page is trusted are performed in response to determining that the web page is called from a potentially untrusted viewport.

10. The method of claim 9 , wherein determining that the web page is called from a potentially untrusted viewport comprises receiving one or more attributes indicating a manner in which the web page is called.

11. The method of claim 10 , wherein the one or more attributes comprise at least one of a parent attribute and an opener attribute.

12. The method of claim 9 , wherein the web page is determined to be called from a potentially untrusted viewport if the web page is to be displayed within a frame.

13. The method of claim 9 , wherein the web page is determined to be called from a potentially untrusted viewport if the web page is to be displayed in a popup window.

14. The method of claim 1 , wherein the instructions are executed by a web browser.

15. A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for preventing a clickjacking attack on a web page, the operations comprising:

receiving a request for the web page; and

in response to the request, providing a web page document underlying the web page, the web page document comprising instructions that are executed in response to loading of the web page for:

inhibiting rendering of content of the web page;

receiving a message from an embedding web page, the embedding web page having called the web page, the message comprising an origin of the embedding web page; and

determining whether the embedding web page is trusted based on an authentication of the origin, wherein rendering of content of the web page remains inhibited if the embedding web page is untrusted, and rendering of content of the web page is executed if the embedding web page is trusted.

16. A system, comprising:

a computing device that executes a web browser, the web browser being operable to execute instructions provided in web page documents for preventing a clickjacking attack on a web page, the operations comprising:

sending a request for the web page; and

receiving a web page document underlying the web page, the web page document comprising instructions that are executed by the web browser in response to loading of the web page for:

inhibiting rendering of content of the web page;

receiving a message from an embedding web page, the embedding web page having called the web page, the message comprising an origin of the embedding web page; and

determining whether the embedding web page is trusted based on an authentication of the origin, wherein rendering of content of the web page remains inhibited if the embedding web page is untrusted, and rendering of content of the web page is executed if the embedding web page is trusted.