I am planning to add iframes to my webpage to sites such as www.dropbox.com and was wondering if the security of the site would be impaired if i did this. As in, could peoples account be hacked if they used my site to access it?
1 Answer
If a site can be loaded into an iframe, then it is vulnerable to clickjacking attacks.
You cannot however use javascript in your site to alter the content and perform actions into the iframe (this applies to different domains), because of the same origin policy mechanism. This applies both ways, a script loaded into the iframe cannot run in the context of the parent frame.
However, there may be drawbacks for loading another site into an iframe. For example, your site is attacked and a persistent XSS is found. The attacker could then replace the dropbox iframe with a fake one he controls and gather user credentials/ data. Because the user cannot easily check the url of the loaded iframe, phising can be more easily done in an iframe.
The other version is also possible . The site you embed in the iframe is hacked and instead of it's normal content it displays a webpage that resembles a login in your page. Using this method, credentials from your site can be collected.
Furthermore, the embedded site can check if it is loaded in an iframe and jump out of it (change window.location) and perform further attacks from there.
As a conclusion, the overall security depends both on the security of your site and of the one you embed.
