233 lines
8.5 KiB
HTML
233 lines
8.5 KiB
HTML
|
<!DOCTYPE html>
|
|||
|
|
<html lang="zh-CN">
|
|||
|
|
<head>
|
|||
|
|
<meta charset="UTF-8">
|
|||
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|||
|
|
<title>点击劫持防护测试</title>
|
|||
|
|
<style>
|
|||
|
|
body {
|
|||
|
|
font-family: Arial, sans-serif;
|
|||
|
|
max-width: 1200px;
|
|||
|
|
margin: 0 auto;
|
|||
|
|
padding: 20px;
|
|||
|
|
background-color: #f5f5f5;
|
|||
|
|
}
|
|||
|
|
.container {
|
|||
|
|
background: white;
|
|||
|
|
padding: 30px;
|
|||
|
|
border-radius: 8px;
|
|||
|
|
box-shadow: 0 2px 8px rgba(0,0,0,0.1);
|
|||
|
|
}
|
|||
|
|
h1 {
|
|||
|
|
color: #333;
|
|||
|
|
border-bottom: 3px solid #4CAF50;
|
|||
|
|
padding-bottom: 10px;
|
|||
|
|
}
|
|||
|
|
.test-section {
|
|||
|
|
margin: 30px 0;
|
|||
|
|
padding: 20px;
|
|||
|
|
background: #f9f9f9;
|
|||
|
|
border-left: 4px solid #2196F3;
|
|||
|
|
}
|
|||
|
|
.success {
|
|||
|
|
color: #4CAF50;
|
|||
|
|
font-weight: bold;
|
|||
|
|
}
|
|||
|
|
.error {
|
|||
|
|
color: #f44336;
|
|||
|
|
font-weight: bold;
|
|||
|
|
}
|
|||
|
|
iframe {
|
|||
|
|
width: 100%;
|
|||
|
|
height: 500px;
|
|||
|
|
border: 2px solid #ddd;
|
|||
|
|
margin-top: 15px;
|
|||
|
|
}
|
|||
|
|
.info-box {
|
|||
|
|
background: #fff3cd;
|
|||
|
|
border: 1px solid #ffc107;
|
|||
|
|
padding: 15px;
|
|||
|
|
border-radius: 4px;
|
|||
|
|
margin: 20px 0;
|
|||
|
|
}
|
|||
|
|
.code-block {
|
|||
|
|
background: #263238;
|
|||
|
|
color: #aed581;
|
|||
|
|
padding: 15px;
|
|||
|
|
border-radius: 4px;
|
|||
|
|
overflow-x: auto;
|
|||
|
|
font-family: 'Courier New', monospace;
|
|||
|
|
font-size: 14px;
|
|||
|
|
}
|
|||
|
|
button {
|
|||
|
|
background: #2196F3;
|
|||
|
|
color: white;
|
|||
|
|
border: none;
|
|||
|
|
padding: 10px 20px;
|
|||
|
|
border-radius: 4px;
|
|||
|
|
cursor: pointer;
|
|||
|
|
font-size: 16px;
|
|||
|
|
margin: 10px 5px;
|
|||
|
|
}
|
|||
|
|
button:hover {
|
|||
|
|
background: #1976D2;
|
|||
|
|
}
|
|||
|
|
#result {
|
|||
|
|
margin-top: 20px;
|
|||
|
|
padding: 15px;
|
|||
|
|
border-radius: 4px;
|
|||
|
|
display: none;
|
|||
|
|
}
|
|||
|
|
#result.show {
|
|||
|
|
display: block;
|
|||
|
|
}
|
|||
|
|
</style>
|
|||
|
|
</head>
|
|||
|
|
<body>
|
|||
|
|
<div class="container">
|
|||
|
|
<h1>🛡️ 点击劫持防护测试工具</h1>
|
|||
|
|
|
|||
|
|
<div class="info-box">
|
|||
|
|
<strong>📌 说明：</strong>
|
|||
|
|
此页面用于测试网站的点击劫持防护配置是否生效。
|
|||
|
|
如果配置正确，下方的 iframe 将无法加载受保护的页面。
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="test-section">
|
|||
|
|
<h2>测试1：尝试嵌入本站页面</h2>
|
|||
|
|
<p>如果看到错误消息或空白 iframe，说明防护 <span class="success">✓ 生效</span></p>
|
|||
|
|
<p>如果能正常显示页面内容，说明防护 <span class="error">✗ 未生效</span></p>
|
|||
|
|
|
|||
|
|
<label for="urlInput">输入要测试的 URL：</label>
|
|||
|
|
<input type="text" id="urlInput" placeholder="http://localhost:5173"
|
|||
|
|
style="width: 400px; padding: 8px; margin: 10px 0;">
|
|||
|
|
<button onclick="testFrame()">测试嵌入</button>
|
|||
|
|
|
|||
|
|
<div id="result"></div>
|
|||
|
|
|
|||
|
|
<iframe id="testFrame" src="about:blank"></iframe>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="test-section">
|
|||
|
|
<h2>测试2：检查响应头</h2>
|
|||
|
|
<p>打开浏览器开发者工具（F12）→ Network（网络）标签 → 刷新页面 → 查看主文档的响应头</p>
|
|||
|
|
|
|||
|
|
<button onclick="checkHeaders()">检查当前页面响应头</button>
|
|||
|
|
|
|||
|
|
<div class="code-block" style="margin-top: 15px;">
|
|||
|
|
应该包含以下响应头：<br><br>
|
|||
|
|
X-Frame-Options: SAMEORIGIN<br>
|
|||
|
|
Content-Security-Policy: frame-ancestors 'self'<br>
|
|||
|
|
X-Content-Type-Options: nosniff<br>
|
|||
|
|
X-XSS-Protection: 1; mode=block
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="test-section">
|
|||
|
|
<h2>测试3：使用命令行测试</h2>
|
|||
|
|
<p>在终端中运行以下命令来检查响应头：</p>
|
|||
|
|
<div class="code-block">
|
|||
|
|
curl -I http://localhost:5173
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<p style="margin-top: 20px;">或者测试生产环境：</p>
|
|||
|
|
<div class="code-block">
|
|||
|
|
curl -I https://your-domain.com
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="test-section">
|
|||
|
|
<h2>测试4：预期结果</h2>
|
|||
|
|
<p><strong>浏览器控制台应显示类似错误：</strong></p>
|
|||
|
|
<div class="code-block">
|
|||
|
|
Refused to display 'http://localhost:5173/' in a frame<br>
|
|||
|
|
because it set 'X-Frame-Options' to 'sameorigin'.
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<p style="margin-top: 20px;"><strong>或者：</strong></p>
|
|||
|
|
<div class="code-block">
|
|||
|
|
Refused to frame 'http://localhost:5173/' because an ancestor<br>
|
|||
|
|
violates the following Content Security Policy directive:<br>
|
|||
|
|
"frame-ancestors 'self'".
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<div class="info-box" style="background: #e3f2fd; border-color: #2196F3;">
|
|||
|
|
<h3>✅ 配置检查清单</h3>
|
|||
|
|
<ul>
|
|||
|
|
<li>✓ vite.config.js 中已配置 server.headers</li>
|
|||
|
|
<li>✓ index.html 中已添加 CSP meta 标签</li>
|
|||
|
|
<li>⚠️ 生产环境需要在服务器（Nginx/Apache）中配置响应头</li>
|
|||
|
|
<li>⚠️ 请参考 SECURITY_HEADERS.md 文档进行生产环境配置</li>
|
|||
|
|
</ul>
|
|||
|
|
</div>
|
|||
|
|
</div>
|
|||
|
|
|
|||
|
|
<script>
|
|||
|
|
function testFrame() {
|
|||
|
|
const url = document.getElementById('urlInput').value || 'http://localhost:5173';
|
|||
|
|
const iframe = document.getElementById('testFrame');
|
|||
|
|
const result = document.getElementById('result');
|
|||
|
|
|
|||
|
|
result.className = 'show';
|
|||
|
|
result.style.background = '#e3f2fd';
|
|||
|
|
result.style.border = '1px solid #2196F3';
|
|||
|
|
result.innerHTML = `
|
|||
|
|
<strong>正在测试：</strong> ${url}<br>
|
|||
|
|
<p>请查看下方 iframe 和浏览器控制台（F12）...</p>
|
|||
|
|
<p style="color: #666; font-size: 14px;">
|
|||
|
|
提示：如果看到空白或错误，说明防护生效 ✓<br>
|
|||
|
|
如果显示页面内容，说明防护未生效 ✗
|
|||
|
|
</p>
|
|||
|
|
`;
|
|||
|
|
|
|||
|
|
iframe.src = url;
|
|||
|
|
|
|||
|
|
// 监听 iframe 加载错误
|
|||
|
|
iframe.onerror = function() {
|
|||
|
|
result.style.background = '#e8f5e9';
|
|||
|
|
result.style.border = '1px solid #4CAF50';
|
|||
|
|
result.innerHTML = `
|
|||
|
|
<span class="success">✓ 防护生效！</span><br>
|
|||
|
|
页面拒绝被嵌入到 iframe 中。
|
|||
|
|
`;
|
|||
|
|
};
|
|||
|
|
|
|||
|
|
// 提示用户检查控制台
|
|||
|
|
setTimeout(() => {
|
|||
|
|
console.log('%c检查点击劫持防护', 'color: blue; font-size: 16px; font-weight: bold');
|
|||
|
|
console.log('请在上方查看是否有 "Refused to display" 或 "Refused to frame" 的错误消息');
|
|||
|
|
console.log('如果有，说明防护配置正确 ✓');
|
|||
|
|
}, 1000);
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
function checkHeaders() {
|
|||
|
|
alert('请按以下步骤检查响应头：\n\n' +
|
|||
|
|
'1. 按 F12 打开开发者工具\n' +
|
|||
|
|
'2. 切换到 Network（网络）标签\n' +
|
|||
|
|
'3. 刷新页面（F5 或 Ctrl+R）\n' +
|
|||
|
|
'4. 点击列表中的主文档请求\n' +
|
|||
|
|
'5. 查看 Response Headers（响应头）\n' +
|
|||
|
|
'6. 确认存在 X-Frame-Options 和 Content-Security-Policy');
|
|||
|
|
|
|||
|
|
// 打印到控制台
|
|||
|
|
console.clear();
|
|||
|
|
console.log('%c=== 响应头检查指南 ===', 'color: green; font-size: 18px; font-weight: bold');
|
|||
|
|
console.log('\n应该包含以下响应头：\n');
|
|||
|
|
console.log('✓ X-Frame-Options: SAMEORIGIN');
|
|||
|
|
console.log('✓ Content-Security-Policy: frame-ancestors \'self\'');
|
|||
|
|
console.log('✓ X-Content-Type-Options: nosniff');
|
|||
|
|
console.log('✓ X-XSS-Protection: 1; mode=block');
|
|||
|
|
console.log('\n请在 Network 标签中查看主文档的 Response Headers');
|
|||
|
|
}
|
|||
|
|
|
|||
|
|
// 页面加载时的提示
|
|||
|
|
window.addEventListener('load', function() {
|
|||
|
|
console.log('%c点击劫持防护测试工具已就绪', 'color: green; font-size: 16px; font-weight: bold');
|
|||
|
|
console.log('使用此页面测试网站的点击劫持防护配置');
|
|||
|
|
});
|
|||
|
|
</script>
|
|||
|
|
</body>
|
|||
|
|
</html>
|
|||
|
|
|