A city payroll approval page can be framed by a third-party origin and overlays the Approve button. What defensive gap does this primarily indicate?
Select an answer to reveal the explanation.
Short Explanation
If a stranger can put a fake glass over your Approve button, you have a clickjacking problem. Missing frame-ancestors or X-Frame-Options is the usual gap. BGP, SMB signing, and newsletter DKIM are different neighborhoods.
Full Explanation
Clickjacking (UI redress) succeeds when sensitive pages can be embedded in hostile frames so users click actions they did not intend. Defenses include Content-Security-Policy frame-ancestors and legacy X-Frame-Options directives that restrict framing. Network and email controls do not address this class. Testers should report missing frame protections on high-impact workflows like payroll approval.