I'm looking at including a credit card form in a page via iFrame but the form app needs parameters passed from the AngularJS app in the parent page in order to complete the transaction.
My concern is that since the iFrame URL (loading the card form app) is dynamically generated, is it vulnerable to an attacker who could hijack the iFrame and point it to an alternative form for skimming the card details?
If this is a legitimate concern, is there a recognised way to prevent such an attack without a full redirect away from the page to an external payment app?