Question: I have a service with a content observer watching the calendar provider and there are some instances where i need to stop the service so the observer's `onchange` does not get called when adding an event and then restart the service when it is added.

In my activity I use `stopService(new Intent(context,Service.class));` to stop the service then I start it up again later on trying to avoid the onchange call when the provider gets changed but it does not appear the service gets stopped because the onchange still gets called causing force closes in my database because my query in my service cant find the event yet.

so how can i get around this problem?

Answer: 
Clicking on the widget needs to open a pop-up window containing a new page -- an iframe is not good enough, it must be a new window -- which is entirely under the control of your web application. Confirm the action, whatever it is, on that page.

Yes, this is somewhat inelegant, but the present Web security architecture doesn't give you any better options.
There is no way to prevent request forgery while under a clickjacking attack. No CSRF defense exists that can withstand a clickjacking attack, because there is no way to distinguish a real click from a fake click on the client side.

OWASP [mentions in their CRSF prevention spreadsheet](https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet#No_Cross-Site_Scripting_.28XSS.29_Vulnerabilities) that one of the preconditions for the CSRF token defense to work is that no XSS attack is underway.

In my view this should also include clickjacking, as the CSRF token even hidden inside iframe cannot defend against clickjacking. The request is being forged by a direct user click.

So in the end we are not really stuck between CSRF and Clickjacking - CSRF defenses are meant for a different type of attacks where there is a lot less power on the side of the attacker.

So towards the questions you mention concerning clickjacking and CSRF:

* *What is the best solution (if any) to this problem?* - The best defense for clickjacking on the client side is to open a new browser tab or a resized browser window with a page from your site and confirm the action there, as @Zack mentions. This is what the twitter button does, and there cannot be request forgery in this scenario either.
* *So there is a duality, it seems you are stuck between CSRF and Clickjacking* - The CSRF defenses are not meant for cases like XSS or clickjacking attacks, they are effective only against less powerful attacks (email with malicious link, post malicious link in forum etc.)