I have a SSL site where a user can select items to purchase, register and pay. For payment, the user is redirected to a payment gateway. Once the payment is completed, the user is redirected to our website.
Now, my client wants to host one form on his non-https site in a secure iframe to get some information(non-sensitive) from the user which is submitted to the SSL enabled site, and the user is also redirected to the SSL site after form submission. Are there any risks associated with such an implementation? Can we improve upon the implementation and check that the user is coming from my client site only?