09-20-2023, 03:15 AM
IntraWeb has all the features (built-in) used to prevent this type of attack:
1- You can prevent IW to run inside an IFrame setting ServerController.SecurityOptions.AllowInIFrame := False;
2- Using ServerController.CookieOptions.SameSite := ssoStrict;
3- Using CSP response headers is also possible. IW won't add any CSP headers by default, but there are plenty of possibilities (And events) for you to inject any CSP header that you need
I believe that preventing to run the IW application in frames would be enough to prevent such attack.
1- You can prevent IW to run inside an IFrame setting ServerController.SecurityOptions.AllowInIFrame := False;
2- Using ServerController.CookieOptions.SameSite := ssoStrict;
3- Using CSP response headers is also possible. IW won't add any CSP headers by default, but there are plenty of possibilities (And events) for you to inject any CSP header that you need
I believe that preventing to run the IW application in frames would be enough to prevent such attack.