5

Are there any security concerns I should be aware of, if I want to give users the ability to embed iframes(for things like Youtube videos) in their generated content on my site. The user generated content is editable by them, so I can't control iframe options like sandbox(though I might be able to do a check on the content when it comes to the server and insert appropriate options there).

If there are risks, I am thinking of either

  1. checking the domain of the iframe being inserted and only allowing select domains like Youtube.

OR

  1. only allowing a select group of trusted users to add iframes in their content.

Thanks.

4

The Origin-inheritance rules for iframes will prevent malicious content within an iframe from accessing the DOM of the parent.

Allowing sensitive control functional, like administrative pages to be placed within an iframe exposes you application to clickjacking. As a result most security-aware application disallow iframes with the x-frame-options.

Iframes can be a vector for XSS if you do not use proper sanitation: <iframe src='javascript:alert(1)'> </iframe>

1

Of the two choices, checking the domain is probably better not for technical reasons, but for social reasons: you (probably) don't want some users to be "more equal" than others.

Can you start with a short list of approved domains and pend for approval attempts that aren't on the list? That gives you a chance to build up your "approved" list relatively painlessly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.