Clickjacking in Sinatra with Cockroachdb

Clickjacking is a client-side attack where an attacker tricks a user into clicking UI elements that are invisible or disguised within an embedded frame. In a Sinatra application backed by Cockroachdb, the vulnerability arises not from Cockroachdb itself, but from HTTP response headers and view rendering that fail to prevent framing. Sinatra, by default, does not set X-Frame-Options or Content-Security-Policy frame-ancestors directives, so if a developer renders pages inside an <iframe> or includes permissive CSP headers, an attacker can embed the authenticated banking or admin page inside a malicious site.

When Cockroachdb is used as the backend database, the risk is compounded if session tokens or user identifiers are exposed in URLs or rendered into JavaScript variables on pages served by Sinatra. An attacker can craft a page that loads the Sinatra app in a hidden frame, overlays transparent interactive elements, and captures clicks that operate on the user’s behalf—such as confirming a transaction or updating an email. Because Cockroachdb often serves as a distributed, strongly consistent store for user sessions or financial records, the impact of a successful clickjacking attack can include unauthorized data access or state changes, even though Cockroachdb does not directly handle UI interactions.

For example, consider a Sinatra route that queries Cockroachdb for a user’s account balance and renders it in an HTML page without anti-framing protections:

require 'sinatra'
require 'pg' # assuming Cockroachdb wire protocol via libpq-compatible driver

get '/balance' do
  conn = PG.connect(dbname: 'appdb', host: 'localhost')
  result = conn.exec_params('SELECT balance FROM accounts WHERE user_id = $1', [session[:user_id]])
  balance = result.first['balance']
  <div>Your balance: #{balance}</div>
end

If this page is served without X-Frame-Options or CSP frame-ancestors, an attacker can embed <iframe src="https://your-sinatra-app/balance"></iframe> on a phishing site and use CSS to overlay buttons or links that the user unintentionally activates. middleBrick scans can detect missing anti-framing headers among the 12 security checks, highlighting this as a finding tied to authentication and UI security.

Remediation focuses on HTTP headers and safe rendering practices in Sinatra. You should add strict frame-ancestor policies and ensure sensitive pages are not embeddable. Below are concrete code examples that integrate with Cockroachdb-backed routes.

1. Set X-Frame-Options and CSP headers

In your Sinatra app, use a before filter to add security headers to all responses or selectively to sensitive routes.

require 'sinatra'
require 'securerandom'

before do
  # Prevent framing entirely
  headers 'X-Frame-Options' => 'DENY'
  # Allow framing only from same origin; avoid 'unsafe-inline' and wildcards
  headers 'Content-Security-Policy' => "frame-ancestors 'self'"
end

get '/dashboard' do
  # Your Cockroachdb interaction logic here
  erb :dashboard
end

2. Parameterized queries with Cockroachdb to avoid injection and leakage

Always use parameterized queries when interacting with Cockroachdb to prevent SQL injection, which could lead to session hijacking used in clickjacking scenarios.

require 'sinatra'
require 'pg'

get '/account' do
  user_id = session[:user_id]
  conn = PG.connect(dbname: 'appdb', host: 'localhost')
  # Use placeholders to avoid injection
  result = conn.exec_params('SELECT id, email, balance FROM accounts WHERE id = $1', [user_id])
  account = result.first
  if account
    erb :account, locals: { account: account }
  else
    halt 404, 'Account not found'
  end
end

3. Avoid embedding sensitive data in JavaScript and ensure safe rendering

Do not output sensitive values like session tokens or user identifiers into JavaScript contexts where they could be extracted via clickjacking UI extraction. Use HTTP-only cookies for session management and keep sensitive data server-side.

# Good practice: do not embed user_id or tokens in HTML attributes that can be read via DOM
# Instead, use server-rendered UI with CSRF protection
enable :sessions
set :session_secret, ENV['SESSION_SECRET']

post '/update-email' do
  user_id = session[:user_id]
  new_email = params[:email]
  conn = PG.connect(dbname: 'appdb', host: 'localhost')
  conn.exec_params('UPDATE accounts SET email = $1 WHERE id = $2', [new_email, user_id])
  redirect '/dashboard'
end

4. Use middleware for consistent security headers

Consider adding a lightweight middleware to enforce headers across all routes, ensuring clickjacking protections are not accidentally omitted for new endpoints that query Cockroachdb.

require 'sinatra'
require 'rack' # available in Sinatra environment

class SecurityHeaders
  def initialize(app)
    @app = app
  end

  def call(env)
    status, headers, body = @app.call(env)
    headers['X-Frame-Options'] = 'DENY'
    headers['Content-Security-Policy'] = "frame-ancestors 'self'"
    [status, headers, body]
  end
end

use SecurityHeaders

# Your routes here
get '/' do
  'Home page'
end

These fixes ensure that even when Cockroachdb serves authoritative data, Sinatra responses are protected against clickjacking by preventing unauthorized framing and safeguarding session context.