1

We are developing a web application. It has several features so the first time the user enters it shows a short video explaining how to use it. We use the iframe approach to embed a video from YouTube (or potentially other streaming services like Vimeo, MS Stream, etc.). The video only shows for authenticated users (we use OpenId + OAuth2) and it will always be a video published by us (no third party content).

Talking with some colleagues about the potential security risks of this approach someone commented that it is not a good idea to embed external content in an authenticated web page because it is a hole through which a malicious user could inject code or gain access to information. Under the hypothesis that the streaming platform used (YouTube, Vimeo, etc.) is secure, and given that the content is controlled by us, I assume there is no security risk here. Googling about it has only reassured this idea. However, I am no expert, so I was wondering if there is something I am missing. Which are the security risks related to use an external video streaming provider in an authenticated web page?

On the other hand, supposing there are risks, I understand the alternative would be to host the video content directly on our servers, but that seems it is not a good idea either. Which are the security risks in this case?

Improve this question
2
  • If one were to go directly to the streaming video (YouTube, vimeo, etc.), how would they be authenticated? Username/password? Unique URL? Nothing?
    – user2320464
    Commented Mar 25, 2021 at 2:03
  • The contents of the video will never contain private information, i. e., it can be accessed by anybody. The purpose of using a streaming platform is avoid self-hosting of the video and all que issues associated with it (need to host different resolutions for different devices, etc. wp101.com/10-reasons-why-you-should-never-host-your-own-videos).
    – joanlofe
    Commented Mar 25, 2021 at 9:28

1 Answer 1

Reset to default
3

... and given that the content is controlled by us, ...

It is not. You embed content from an external site. While you've uploaded the content to this site with the intend that it will be shown in your site, this is only a wish and the third party site is actually free to do what it wants.

Still, a cross-origin iframe provides usually a solid separation and protection against injection into the embedding page, as long as there is no explicit data exchange (postMessage etc) going on with the iframe content.

But, the shown content of the iframe may change to something different and this is out of your control. This might just be irritating (like video not shown and instead error message) but it might be also used for phishing (like asking for credentials) since from the point of user it is not clear that this content of the page is not controlled by the trusted party (i.e. you).

Improve this answer
4
  • 1
    Indeed. Videos sourced from third party sites using their players are only one policy change away from having advertisements inserted.
    – Booga Roo
    Commented Mar 24, 2021 at 3:43
  • Ok. That's a good point, it's true that the provider can do whatever they want. But I want to analyze the risks under the assumption that the provider is "well behaved", i. e., we suppose they won't change our content and that they are secure enough (i. e. they provide more security on that content that what we would be able to achieve on our own). In fact, I've talked about YouTube, but we could use a paid streaming service that provides more guarantees about policy changes. Also, any issues with hosting your own videos?
    – joanlofe
    Commented Mar 24, 2021 at 8:50
  • @joanlofe: "Also, any issues with hosting your own videos?" - this is a different question. But given that videos are static content only I don't see any new security problems. You should be instead on the safer side when hosting it by your own. Of course, there are additional bandwidth requirements and potentially associated costs.
    – Steffen Ullrich
    Commented Mar 24, 2021 at 10:23
  • @joanlofe: "But I want to analyze the risks under the assumption that the provider is "well behaved" ... " - the question is how much control you actually have. The less control, the less secure. Self-hosting means most control. Note that the third party does not need to be explicitly malicious, in can simply forget to renew a domain, allow third-party ads inside the video which might be used for scamming etc.
    – Steffen Ullrich
    Commented Mar 24, 2021 at 10:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .