Let's say I have logged in to my site
Malicious Site has an iframe embedding
Genuine Site. Will the embedded iframe in the
Malicious site have access to my login credentials from
Genuine Site which I have logged in, in another tab?
The user has no knowledge of the iframe hidden in the
Malicious Site. It is a hidden DOM.
Should this be possible, the
Malicious Site can now programmatically issue requests with proper credentials as the iframe has access to the session data. How should I rectify this issue?