Clickjacking is an attack that loads your site inside an invisible frame on a malicious page, then tricks the user into clicking elements they cannot see. The victim thinks they are interacting with the attacker's page, but their clicks land on your app, potentially confirming an action or changing a setting without their knowledge.
How it works
The attacker embeds your page in an iframe made transparent and positioned under decoy content. The user clicks what looks like a harmless button, but the click passes through to your framed page, for example a confirm or delete control, using the user's own logged-in session.
How to stop it
Tell browsers not to let your site be framed by others. Send a Content-Security-Policy with frame-ancestors set to your own origin (or none), which is the modern control, and optionally the older X-Frame-Options header for legacy browsers. With framing denied, the invisible-overlay trick cannot load your page at all.
What this means for AI-generated code
Generated apps usually ship without frame protection because nothing in the build process requires it, and the app works identically with or without the header. That leaves any sensitive click-driven action open to being framed and hijacked.