Preventing clickjacking
Clickjacking occurs when your web application allows itself to render inside a nefarious website (typically through IFrames), thus altering the whole UI. The user is then presented with a different-looking page, tricking them into executing an unbeknownst action on your web application by having the user think that they are interacting with the deceiving page, while they are actually entering information and clicking buttons on your web application instead.
To protect your ASP.NET Core web application from falling victim to clickjacking exploitation, you can implement a CSP that will stop an IFrame from a malicious website from rendering your web app.
Getting ready
We will be using the Online Banking app we used in the previous recipe here. Run the sample app to verify that there are no build or compile errors. In your command shell, navigate to the sample app folder at \Chapter12\clickjacking\before\OnlineBankingApp and run the following command:
