DoubleClick jacking: Why Your Clickjacking Headers Never See It Coming

The attack never puts your page in a frame, so the headers on NGINX, Cloudflare and CloudFront have nothing to block. Here is how it works, what actually stops it, and an Angular component with tests you can copy.

It’s Friday, 4:40 p.m., and your security review just came back clean. The report has one line you’re proud of: “Clickjacking: protected.” You set X-Frame-Options and frame-ancestors on NGINX months ago, the scanner agrees, and your session cookie is SameSite=Lax.

Then a teammate drops a link in chat. “Try this. Just double-click the box.”

A fake verification window pops up. You double-click. Nothing seems to happen. Ten seconds later you open your account settings, and a stranger’s app is sitting in the list of connected apps with permissions you never agreed to.

You never saw a consent screen. You never even saw your own site.…