In a secured area of a partner site we would like to embed an iFrame. The partner will generate a hash (accessToken) that will form a part of iFrame's src, e.g. <iframe src="our-domain.com?hash={accessToken}" />.

In this manner the partner will get access to our admin area. We would like to secure the sensitive data to be open only from the partner site.

My ideas to secure our page from being open outside the iframe:

  • X-FRAME-OPTIONS - but it seems useless as you can open the link in the unsupported browser or a new page, see this answer
  • Mark hash as used - as soon as GET is called on our-domain.com?hash={accessToken} we will mark the accessToken as used so that subsequent GETs won't be possible. But isn't it possible to prevent iFrame from being loaded and steal the uri?

What other options could we use? Or is it secured enough already?

  • I'm not sure I fully understand your scheme, can you add more detail (how is the token exchanged? do all your pages need protection? How do you check on your site?)? But in general, you do not want to create custom solutions for well-known problems, but use best-practices instead (ie x-frame and/or csp, plus possibly frame busting scripts as backup for old browsers). – tim Mar 11 '17 at 21:35
  • Sounds like he wants the opposite of a frame buster, something that will prevent the site from being accessed unless it is within an iFrame. And the iFrame must be embedded in an HTML page that came from a specific domain. Is that right, OP? – John Wu Mar 11 '17 at 22:32
  • @JohnWu you are right, that makes sense. And in that case X-Frame-Options is indeed a bad option because ALLOW-FROM is not supported by Chrome. – tim Mar 11 '17 at 22:44
  • OP, should I assume that your site and your partner's site have nothing in common on the back end (they have separate databases and don't talk to each other at all)? – John Wu Mar 11 '17 at 23:09
  • @JohnWu, you got it. "he iFrame must be embedded in an HTML page that came from a specific domain" is true :) – Amio.io Mar 12 '17 at 7:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.