Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My website has an iframe used for loading my client's websites (only 5).How can I make sure the iframe is secure? Also by editing iframe src It allows to load any other websites.How can I prevent it?

share|improve this question
What exactly do you want to prevent? What do you mean by "editing iframe src"? – Joel L Aug 1 '13 at 15:26
up vote 3 down vote accepted

There is no way to dictate how a client chooses to execute the HTML/JavaScript you provide. This should never be a security concern. If you are loading this iframe src based on a GET variable, then this is XSS: http://site?iframe_src=javascript:alert(document.cookie). In this condition an attacker can introduce JavaScript into another user's session, and this is a serious security concern.

If a site can be placed within an iframe, then it is vulnerable to ClickJacking. This does not expose the parent site that hosts the iframe, but rather any site is subject to this type of manipulation. There are ways of mitigating ClickJacking for sites that must be frame-able.

share|improve this answer
OMG. When I checked that, I got javascript pop up.How Can I block it? – Harikrishnan Aug 5 '13 at 4:06
@make sure the url is on a whitelist. – rook Aug 5 '13 at 17:25
Could you please explain little more? – Harikrishnan Aug 6 '13 at 3:49
@so you have a GET variable iframe_src, seeing as HTTP variables are attacker controlled and the basis of 99.9999999999999999% of all web app vulnerabilities this should be a concern. Before you write this variable to the page, make sure it is a url you trust. Done! – rook Aug 6 '13 at 3:52
Now I got it. thank you so much – Harikrishnan Aug 6 '13 at 9:33

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.