Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've seen websites placing HTTPS iframes on HTTP pages.

Are there any security concerns with this? Is it secure to transmit private information like credit card details in such a scheme (where the information is only placed on the HTTPS iframe form, and not on the HTTP parent page)?

share|improve this question

5 Answers 5

up vote 27 down vote accepted

If only the iframe is https, the user cannot trivially see the URL it points to. Therefore, the source http page could be altered to point the iframe anywhere it wanted to. That's pretty much a game-over vulnerability that eliminates the advantages of https.

share|improve this answer
5  
+1 for pointing out the importance of server authentication, which is often forgotten as a benefit of SSL. –  AviD Nov 30 '10 at 19:14

In addition to the possible hijacking scenarios already given, you may run into issues on IE6/7 if you point to either an HTTP or HTTPS page requiring login. Basically, the cookies from the iframe's page are expecting you to be using the same protocol (HTTP or HTTPS) and so if the page you're putting the iframe on is using HTTP instead of HTTPS, it would prevent the user from being able to log in.

share|improve this answer
    
this answer seems jumbled. I'm not sure what you are trying to say, or what problem you are alluding to. –  D.W. Jun 4 '11 at 5:17

Yes, while most recent browsers will properly sandbox the SSL parts, you are undermining all the functionality added to browser chrome to provide user feedback regarding the contents. I for one would not provide any sensitive information without checking the URL showing in my browser.

share|improve this answer

A HTTPS iframe within a page served over HTTP will not allow the user to be sure they are actually using the HTTPS connection that they expect to be, therefore this potentially allows the iframe to be hijacked in a simple attack, such as an iframe injection. This would allow password harvesting, etc. Such an attack could begin through a trojan, a virus, visiting a malicious

share|improve this answer

iFrames will expose the inner HTTPS site to numerous javascript and cookie attacks in older browsers, and may cause issues in newer browsers.

To fix this, look up "Frame Busting" to detect if iFrames are being used. Consider this solution on StackOverflow:

http://stackoverflow.com/questions/958997/frame-buster-buster-buster-code-needed

In that code, you can detect if iFrames are being used, and offer alternative content to direct the user to the proper site.

share|improve this answer
1  
+1 cuz iframes suck... –  AviD Nov 30 '10 at 19:13
    
iframes don't suck –  Druska Feb 20 at 3:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.