Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I found one of the website is loading all shopping websites in their own domain.

Eg . having links like , , , ....

if we click on it leads to

and loads the inside this domain.

if some one purchase the product from . Is it possible for to caputer all user data including payment credentials.

share|improve this question
Bear in mind that this sort of configuration is widely required for 3rd-party payment systems. Payment processors will offer a checkout card details iframe to a different site in conjunction with tokenization to reduce the merchant's PCI scope. – gowenfawr Oct 7 '13 at 13:38
up vote 1 down vote accepted

No, as long as the CORS Access-Control-Allow-Origin is at its default restrictive value. This prevents the outer website from accessing the framed website via Javascript/etc.

CSRF attacks are still possible, though most sites protect themselves from this.

Note that you should be sure that the iframe is indeed on the correct domain (right click>view frame info on chrome) and is not being phished.

share|improve this answer
So is it illegal to load some own's domains into another domain even or without their knowledge – Ragavendran Ramesh Oct 8 '13 at 4:56
@RagavendranRamesh Not in general, but some sites may have a content policy that disallows that. – Manishearth Oct 8 '13 at 5:18

There are the issues Manishearth raised but also the possibility that as the site is loaded in an iframe they could overlay their own text fields over credit card input fields for example.

It's like a slight variation of a clickjacking attacking and whilst the host site isn't stealing data from the site they are framing, they're just tricking you into inserting it into the host site instead.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.