Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Sorry if this has been answered before, I couldn't really find this exact example and I wanted to get a clearer answer for a client.
I understand that an iframe with a https payment portal on a http (non secure) embedding site isn't safe.
If the site with the embed is https, and the payment portal embedded with an iframe is https, is that secure or would it be better to just forgo the iframe and link directly to the portal off site? And if so, why?
Thanks in advance :)
Embedding and SSL frame in and HTTP page is only unsafe if the host page is MITM’d and replaced with a phishing host and phishing frame. This is the only danger. The same origin policy protects everything else so long as they are on different origins (I assume they are because why else would you not have SSL on this page?).
Against a passive attacker, this is safe. If they are actively modifying your traffic and change the frame SRC URL all bets are off. The content of the original page is of course safe still but it’s very hard to know what the actual location of an iframe is as a user.
