4

I'm looking at including a credit card form in a page via iFrame but the form app needs parameters passed from the AngularJS app in the parent page in order to complete the transaction.

My concern is that since the iFrame URL (loading the card form app) is dynamically generated, is it vulnerable to an attacker who could hijack the iFrame and point it to an alternative form for skimming the card details?

If this is a legitimate concern, is there a recognised way to prevent such an attack without a full redirect away from the page to an external payment app?

Improve this question

1 Answer 1

Reset to default
3

X-FRAME-OPTIONS to your rescue!

If you want to load a page from one app to an iFrame on another use the "ALLOW-FROM uri" setting.

Good Reads:

  1. The X-Frame-Options response header
  2. Clickjacking Defense Cheat Sheet
Improve this answer
1
  • 1
    definitely worth following up - thanks. This is actually the opposite of what I was concerned about though. This deals with controlling whether a page can be loaded in a frame and under what circumstances. What I was thinking of is when I have a page (A) with a frame containing a credit card form (B). I was asking whether there is a possible attack on A which would cause it to load a false credit card form (C) into the frame instead allowing cards to be skimmed.
    – Peter Whitfield
    Sep 24, 2015 at 23:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .