I'm working for a company that wants to allow anyone to embed an iframe in which users can buy products on potentially any site. So it would be a typical use case for users to enter in their credit card info into this iframe.
I'm aware that clickjacking is a typical attack vector for this sort of set up. However, that vector seems like it's more about inducing a victim to click a button inside an iframe more than inducing them to take a complex action like completing a checkout procedure.
What I need to know before I feel comfortable implementing this iframe:
- Is this setup still vulnerable to clickjacking?
- Is it possible to read information entered into an iframe like this through a keylogger or invisible divs floating on top of the iframe?
- What other potential attack vectors are there in a setup like the one I described?
- Are there additional security considerations I should be thinking about?