2

We have two sites, app.company.com and www.company.com. Right now, users are trained only to enter their login credentials on app.company.com. Both sites use SSL. The app.company.com uses CSRF and we actively scan for security vulnerabilities. www.company.com, hosted at a separate hosting company, is not treated with the same level of care because there's no customer data on it.

Now, we'd like to be able to present a login form on www.company.com which submits to app.company.com, so the login form can be more easily skinned; colours changed, graphics inserted, that sort of thing. But we'd like to do this securely. I can't immediately see a secure way of doing so.

The closest I can think of is to have an IFRAME, but even that appears to be vulnerable to clickjacking. Additionally, if www.company.com was compromised, there'd be nothing stopping them from just replacing the IFRAME with a regular form and capturing the form contents.

So, my question is this. Is there a way to allow users to submit their username and password from an unsecure site without compromising security?

Improve this question
5
  • 1
    I dont see the reason why www.company.com has to host the login form. If you have access to app.company.com, you can skin it, too, cant you? I´d just place a link to the login form on www.company.com.
    – marstato
    Apr 14, 2016 at 19:55
  • Yeap, we can skin it. It's a question of developer time vs marketing time, though. I wonder; would it be safe to host the login form on app.company.com and serve marketing content in an IFRAME? i.e. do things the other way around than I was suggesting in the question?
    – ChrisInEdmonton
    Apr 14, 2016 at 19:59
  • The point is: if the compromise of www. is a possible thread, it cannot host a login form of any kind. When including content from www. on app. you'll have to pay very much attention that no code from www. can execute on app. (i.e. break out of the iframe)
    – marstato
    Apr 14, 2016 at 20:03
  • What about giving options to skin/theme app.company.com and just have company.com link to app.company.com? If it is a per client thing then set them up with client.company.com with a wildcard SSL cert with wildcard subdomains pointed at the app codebase. Then have your app get the subdomain to load in their custom theme settings. app.company.com retains all control of the login form and users are trained to login via their preferred/branded site.
    – Bacon Brad
    Apr 14, 2016 at 20:08
  • @baconface, a very excellent idea. I think that's what we'll end up going with.
    – ChrisInEdmonton
    Apr 14, 2016 at 20:24

1 Answer 1

Reset to default
4

Is there a way to allow users to submit their username and password from an insecure site without compromising security?

No. As you realized yourself in your question the site could be compromised and everything replaced. And this could be done in a way that the user is not aware of this.

Training the users to trust such an insecure site is a bad idea because not only the login credentials could be grabbed but the trust in this site could also be used in social attacks. For instance the site could claimed that a plugin or browser update is needed to continue and thus make the user install malware.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .