I have a SSL site where a user can select items to purchase, register and pay. For payment, the user is redirected to a payment gateway. Once the payment is completed, the user is redirected to our website.

Now, my client wants to host one form on his non-https site in a secure iframe to get some information(non-sensitive) from the user which is submitted to the SSL enabled site, and the user is also redirected to the SSL site after form submission. Are there any risks associated with such an implementation? Can we improve upon the implementation and check that the user is coming from my client site only?

  • 1
    If the top level frame doesn't use SSL, the user can't see you're using SSL and thus is trivally vulernable to SSLStrip – CodesInChaos Aug 11 '14 at 14:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.