2

Traditionally most Payment providers only provide Hosted Payment Sites via redirect or iframe. But now an increasing number is also supporting payment integration via a Javascript library.

I imagine the case in which an attacker is able to inject code into the Web App: the attacker would still not be able to read the iframe's content because of Same-origin policy. On the other hand in the JS lib case, a jQuery 1-liner is enough to send the user's credit card data to some server.

Is this view correct? Or are both options equally safe, because once an attacker can inject code, he could do (almost) anything anyway?

| improve this question | |
4

Although the same-origin policy may stop an attacker from accessing the legitimate iFrame content, the problem is that the user has no way to verify that they're actually interacting with the legitimate iFrame (short of going to the source which most users won't do). An attacker could just as easily replace the iFrame source with a phishing page and gain the users credit card details that way.

Both iFrame and JS based gateways are vulnerable to approximately the same issues, so I would argue that they're both equally insecure compared hosted gateways. The benefits of hosted gateways are that:

  • The user can verify the URL to be sure who they're interacting with
  • The user can validate the SSL/TLS certificate and encryption to be even more sure about who they're interacting with
  • A payment gateway operated by a bank is most likely better tested for vulnerabilities than some arbitrary site.
  • Users can be reasonably confident in the integrity of their payment details if the totals, etc. are displayed by the external gateway. Compared to onsite where the site may say they'll charge you one thing then charge you another.

On the other hand, transferring users to an external payment gateway is considered a bad user experience and interfacing with a payment processor securely on the server side is complicated, so compromises are made and these JS based gateways are becoming popular.

| improve this answer | |
  • Good answer, but I think 'equally insecure compared to hosted gateway' has a synonym of 'equally secure'. – gowenfawr Sep 2 '14 at 13:10
  • 1
    @gowenfawr yes, you're right but I'm trying to make the point that neither iFrames or JS gateways are a security feature over a hosted gateway. They're basically a compromise which depends more heavily on the integrity of the client website. – thexacre Sep 2 '14 at 20:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.