3

Working on a public website where the login form is located on a separate page on it's own subdomain. One of our biggest goals at the moment is to try to promote users to log in to the site more frequently. My first suggestion was naturally that we should make the login form (username and pwd inputs) available directly from the header of the main site.

The guy responsible for the login system told me this was out of the question - since we have a lot of 3rd party scripts (ads etc) on the main site, it would be a security risk to have the login form accessible anywhere on the main page. The login must remain on a separate page where there are no 3rd party scripts. Displaying the login-page inside an iframe on the main site was not an option.

I trust him but just wanted to double check. Is there truly no way to have a secure site with 3rd party scripts and username+password inputs directly accessible on the page? Should any site with ads be considered unsafe if the login form is not on a separate page?

  • 1
    It can be true in some instances if there is a vulnerability that allows 3rd party scripts to do things like mimic the login form fields. – schroeder Aug 30 '17 at 21:15
  • 3
    What login page do you know also has things like ads and other 3rd party scripts running? – schroeder Aug 30 '17 at 21:17
1

I do agree with him that this is a concern, there are two ways to mitigate this:

  • Don't load scripts from external parties
  • Run it on a seperate page without third party scripts on any of the admin pages

Third party scripts, especially advertisements, are sometimes susceptible to hijacking by malicious entities. There are two main associated risks with running this script:

  • Someone might inject a phishing form to phish your credentials
  • Someone might use it to steal your session information

Additionally, for most sensitive websites, we even recommend restricting the administrative pages to certain network ranges only. They should preferably not be accessible from the Internet.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.