2

This question already has an answer here:

For a certain functionality, I can either 1. Redirect my user to a partner website. 2. or, Open up the partner's website in an iframe.

Supposing the partner was malicious and/or easily hacked, what are the security risks of using an iframe instead of using a redirection?

So far I see that the embedded iframe could trick the user into clicking links within it. However, this can happen if we redirect as well. Can the embedded partner hijack portions of my site from within the iframe? Are there other risks?

marked as duplicate by S.L. Barth, Xander, John Deters, Rory Alsop Oct 15 '16 at 14:49

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 6
    With an iframe, the browser address bar still shows your site, so if an external site asked for a password, users would think they're telling your site the password, when in reality they're telling the external site. – paj28 Oct 14 '16 at 11:11
  • 1
    @J.A.K., I can see how the accepted answer there is not very reassuring or specific. – Bryan Field Oct 14 '16 at 14:03
  • i've outlined multiple typed of malicious content that can be loaded, off the top of my head that is the only vector i can think of. And it certainly was not meant to be reassuring. – J.A.K. Oct 14 '16 at 14:18
  • 1
    @J.A.K Your answer to the other question was great. However, I was unsure of how the same problems would'nt exist if I redirected to the partner site. Thus I asked a more specific question here. – Chip Oct 14 '16 at 17:53
1

You should look into the HTML5 Sandbox options. While these are not supported in all browsers, they can be helpful to restrict certain actions the attacker might take, such as redirecting the user (replacing your page) rather than being contained in the iframe.

Thanks to Same Origin Policy, JavaScript and other plugins should stay fully contained within the iframe.

Obviously there is the risk of a vulnerability in the user's setup. This is more likely in a plugin than with JavaScript. However I believe the risk difference there is quite small when comparing iframe vs redirect as you are asking. I would say that redirect (or popup window) is ever-so-slightly safer.

Ideally, you only allow such redirection or iframing to your Partner, and not to 'any random site'. Less-tech-savvy users are more easily tricked into downloading malware from tricky malicious sites. If you only allow a select set of sites (i.e. just partners as you say) then you are less likely to be accidentally guiding users to such tricksters.

@paj28 makes an excellent comment:

With an iframe, the browser address bar still shows your site, so if an external site asked for a password, users would think they're telling your site the password, when in reality they're telling the external site.

This does not affect the Remember Password feature of the browser, but @paj28 is correct that users may not realize the presense of an iframe at all.

I would suggest that a header bar above the iframe be visible to clearly indicate that the visitor is on someone else's site, and to give them a convenient way to return to the safety of a page on your site.

As for redirect, while the URL bar would show the destination site (unlike iframe), it also gives the destination site full control of the site display (you can't include a header bar) so that might make it easier for them to phish the user's password, as many users rely on visual cues (i.e. an official looking header & logo) more than the URL bar.

Finally, I'd point out that well-known sites, before redirecting a user away, would provide brief announcement that it may be unsafe. I personally find such notifications annoying, but it may help from a security standpoint.

Not the answer you're looking for? Browse other questions tagged or ask your own question.