Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [iframe]

The HTML Inline Frame Element is a nested browsing context, embedding another HTML page into the current page.

Filter by
Sorted by
Tagged with
0 votes
0 answers
7 views

How to access iframe.contentWindow.document of a nested iframe inside an iframe? [migrated]

I've been trying all day to nest created iframes and access their contents, but security restrictions dont let me. Is there a way? I shared my code and everything i tried so far in a codepen. https://...
serapath's user avatar
0 votes
0 answers
73 views

Is it possible to track cross origin redirection?

I can successfully iframe a page on origin B from origin A (no x-frame-deny, content security policy, etc). A page on origin B (page X) redirects to a page on origin C (page Y) with a server side ...
Hackermon's user avatar
13 votes
3 answers
7k views

Why are iframes allowed by default?

Clickjacking is still very possible in 2024, because iframe embedding is allowed by default. Why is this the case? In 2013 there was a question about why iframes exist at all (Why are iframes allowed ...
yeerk's user avatar
  • 238
1 vote
0 answers
94 views

Can an embedded 3rd party JS script access or keystroke log an iFrame's content

Say there is a web page with two 3rd party javascript URL scripts embedded in it. One creates a support chat window and the other creates an iFrame within which a user enters payment information into ...
AndyW's user avatar
  • 111
1 vote
2 answers
7k views

How to pass authentication to iframe from host app?

I will implement a chat bot web app that can be used on other websites. I plan to to host this app in www.mysite.com and customers will be able display this chat bot inside an iframe on their sites. ...
Ismail's user avatar
  • 11
0 votes
0 answers
154 views

In a web application, what would you consider the best way to store secret keys obtained via an SDK?

Currently I am working on an application that requires secret keys to encrypt and sign information generated by the client and transmited over the wire, these keys are granted per user. Currently when ...
Ray's user avatar
  • 1
0 votes
1 answer
1k views

How to display first party website to third party website | inside the Iframe

I have www.example.com a WordPress website and www.official.com this third-party website, I want to invoke <iframe src="www.example.com"></iframe> in www.official.com Here my ...
Fasal Basha's user avatar
1 vote
0 answers
278 views

How do I protect API keys used to authorize an iframe-based client?

I'm building a service composed of a backend API and an embed-able, iframe-based, front-end client. Only authorized customers should be able to access the backend API via the iframe embed. My plan is ...
Robert Glissmann's user avatar
2 votes
1 answer
687 views

Cookie flow in a site that hosts embedded Youtube video

When there's a Youtube video embedded on a site that I visit while I am logged in Youtube beforehand,how does the embedded video know that it's me so I can add it to my Watch Later list? I think the ...
microwth's user avatar
  • 2,473
0 votes
3 answers
1k views

What XSS attacks could somebody perform through an iframe?

If a potential attacker was able to upload a cross-origin <iframe> element to your website as a post of some sort, what could they actually do through it? I know that cross-origin <iframe> ...
Blue Herring's user avatar
0 votes
1 answer
310 views

Can you have an <iframe> tag with no spaces?

I am looking to figure out how to create an iFrame tag without any spaces. I have found an input on a Bug Bounty program that reflects my input back into the page, and allows me to escape double ...
ex7lted's user avatar
  • 50
1 vote
0 answers
260 views

do I need CSP: frame-ancestors on a redirect page?

We are implementing clickjacking protection on our website as follows: By default every page on our site has frame-ancestors self We have a list of pages that are specifically designed to be ...
Uriel Zylbermann's user avatar
1 vote
2 answers
864 views

XSS against jQuery PortSwigger challenge

I am trying to do this jQuery XSS challenge here by PortSwigger. They have a good walkthrough for XSS attacks, however I could not find anything on jQuery, which is also a programming language I have ...
questioner's user avatar
0 votes
0 answers
105 views

bruteforce attack inside iFrame

How can I change the value of src parameter inside the iFrame tag with programs like wfuzz or fuff? For example I have an iFrame on the server like this: iframe.php <html> <head><title&...
Freeman's user avatar
  • 241
2 votes
1 answer
306 views

What sandbox does an <object> element run in? Can this sandbox be configured?

I run a site that displays user-generated SVGs. They are untrusted, so they need to be sandboxed. I currently embed these SVGs using <object> elements. (Unlike <img>, this allows loading ...
jameshfisher's user avatar
2 votes
0 answers
845 views

What's the best way to handle authentication across multiple different domains under the same service?

For a social networking site example.com, users all have their own domains. How can you keep someone seamlessly authenticated across all domains? For the main site, example.com, I am currently using: &...
ewfoji's user avatar
  • 21
11 votes
3 answers
3k views

Would a hostname from an HTTPS iframe leak if loaded after a successful connection with another HTTPS hostname which displayed the iframe

If your internet traffic had an eavesdropper and you access a website using HTTPS from my understanding they would know the domain name (hostname) that you visit (as well as some other things), but if ...
Danny Palma's user avatar
0 votes
0 answers
239 views

Selective frame busting without HTTP headers

Why... Just Why... Due to Shopify being unwilling to modify security headers further then removing them, the Cloudflare "Orange-to-Orange" problem (since Shopify uses Cloudflare as well), ...
Tyler's user avatar
  • 21
1 vote
2 answers
486 views

abiliity to change elements in HubSpot iFrame forms

I recently started working on adding custom code to HubSpot forms after their form is loaded via an iFrame. Initially, I was using the following code to access the iFrame to change it: var form = ...
Pshivvy's user avatar
  • 113
15 votes
2 answers
6k views

How do I safely host third-party Javascript code in an iframe?

I'm building a website where users, among other things, can add embeds (YouTube, Google Forms, Airtable...) and show those embeds to other people. Embeds are snippets of HTML that can include <...
qff's user avatar
  • 263
0 votes
1 answer
1k views

Why some payment methods allow being embedded in an iframe and some don't?

Let's take some examples: Pay Pal, Apple Pay (examples via Saferpay) - will not load in an iFrame Visa Checkout, Stripe (example), Saferpay (link above) - credit card data can be input in an iFrame ...
user2530062's user avatar
1 vote
1 answer
2k views

srcdoc attribute of iframes as a source of XSS attacks

I am trying to implement a case where a user provides us some html code which is then stored in our database. We then retrieve the HTML from our database as a string. (We have no control over the user ...
pepper's user avatar
  • 11
0 votes
1 answer
1k views

Is frame busting javascript required despite x-frame-options

I am using x-frame-options sameorigin header to prevent some of my websites from being loaded in iframes. Is this a foolproof method to prevent iframe loading? There have been several old threads on ...
Kannan's user avatar
  • 107
4 votes
1 answer
1k views

How to create a secure embeddable HTML form?

I have an https website and I want to let other websites embed one of the pages on my website that lets users of my service log in and submit a form, similar to Paypal's payment iframe or Plaid's Link....
Luciano's user avatar
  • 143
12 votes
4 answers
4k views

How does collecting sensitive data using iframes increase security?

So this approach seems to be rather popular, particularly among payment processors that provide javascript integrations. The added layer of security that "fields in iframe" brings also ...
Acorn's user avatar
  • 222
1 vote
1 answer
996 views

cant a CSRF token be stolen using iframe?

from what I understand a common approach to storing a CSRF token would be: the client retrieves from the server a CSRF token the token is stored in an input element inside the form like this: <...
OriFl's user avatar
  • 13
1 vote
0 answers
185 views

Prevent XSS in 3rd party (self hosted) application

We have an application which have purchased from a 3rd party and host in our own environment. The application consists of its own UI and back-end, and is included in our own application through an ...
almisson's user avatar
2 votes
0 answers
133 views

Should i login to my ebanking account through frames in another website?

During a credit card payment to site X , it asks me to login to my ebanking account through a frame in a site that handles that transaction in order to implement a more secure authentication (3d ...
chomwitt's user avatar
2 votes
0 answers
306 views

Can this recommended OWASP framekiller code for protecting browsers that don't support X-Frame-Options be circumvented?

I have read and seen that javascript framekiller code doesn't seem to be widely espoused as a panacea solution. It's target use case seems to primarily be for legacy browsers or old browser versions ...
user1821961's user avatar
0 votes
1 answer
261 views

Are there security issues around controlled cross site sharing behind SSO?

Very simply we have a ton of websites at our company behind SSO. I am having a hard time figuring out what security issues there are if we open cross-site sharing between these sites but wanted to get ...
blankip's user avatar
  • 118
0 votes
0 answers
1k views

Passing confidential data to an IFrame

There are two different web applications Host and App which are hosted separatedly, i.e. in particular on different domains. App is not designed to be accessed directly. Rather users are expected to ...
kremerd's user avatar
  • 198
1 vote
0 answers
127 views

Allowing 3rd-party cookies in major 2020 browsers [closed]

I'm trying to get 3rd party cookies to work on major mid-year 2020 browsers [1]. It's as simple as pointing an iframe to an external URL to make a cookied request and probably get the response ...
Pacerier's user avatar
  • 3,313
1 vote
1 answer
1k views

What are the security risks of allowing users to add iframes?

In my web app I'm using a good sanitizer which let's me to whitelist some specific html tags. I'd like to allow <iframe> so that users can insert youtube videos and so on. However I'm worried ...
Karlom's user avatar
  • 145
0 votes
0 answers
549 views

Is it safe to embed a google form on a website without an SSL Certificate?

I designed a Google Form for a website which does not have an SSL Certificate. I have planned to embed it onto a page using an iframe tag. I am currently testing it and have published a test page with ...
user avatar
1 vote
1 answer
424 views

User submitted iframes - what to watch out for?

I'm building a part of a site where users can embed Youtube videos into their profile. I'm planning to have them get the embed iframe from Youtube directly, and submit that to our server. We're then ...
preferred_anon's user avatar
1 vote
1 answer
431 views

IFrame Vulnerability Classification

I was participating in a bug bounty on a website we will call example.com, when I ran into a very strange edge case which I am not sure I should report. The website uses ads and tracking similar to ...
Michael Hoefler's user avatar
2 votes
1 answer
369 views

Does FB share button contain trackers?

I am considering putting a Facebook share button (shown below) on my website to encourage people to share content to their FB page. However, I do not want cross site trackers "bloating" my website or ...
sam's user avatar
  • 283
0 votes
1 answer
2k views

WYSIWYG Rich text editor and renderer with no XSS risks

In our web app, we need to allow users to input rich text which is then presented to other users. We are looking for a simple WYSIWYG (JavaScript) editor that outputs a format which is backwards ...
advance512's user avatar
0 votes
1 answer
424 views

Assuming I own the client. Is it acceptable to embed my authorization servers login page in an iframe?

We have an authorization server which exposes a login page, we would like to authenticate users in our single page app using this authorization server. My employer does not want to redirect users to ...
TacticalMin's user avatar
2 votes
2 answers
708 views

Can cross origin iframe be detected in web logs

A recent blog post shows hackers owning a web server - at least the content and injecting a web skimming attack. https://blog.malwarebytes.com/hacking-2/2020/03/criminals-hack-tupperware-website-with-...
Johann's user avatar
  • 21
3 votes
1 answer
3k views

Is there any way to access the contents of a cross domain iframe

I found that a subdomain of a site leaks all cookies of the site due to improper error handling. Now, I found that this site does not have X-Frame Options Header in it. So, I put this subdomain in the ...
Phenomenal One's user avatar
2 votes
1 answer
661 views

Why we should not mix http and https when using iframes?

In the administration of advanced iframe I came across following: "Please do not use a different protocol for the iframe: Do not mix HTTP and HTTPS if possible!". Please explain the below points. ...
Heena Vora's user avatar
0 votes
1 answer
533 views

Drive by download with iframes

Does the definition of a drive by download include malicious execution of an unaccepted downloaded file or is the unaccepted download of a file the drive by download by itself? I didn't find a good/...
Tibi's user avatar
  • 3
0 votes
0 answers
111 views

What to consider for determining something as a security flaw?

Recently, I found an iframe injection vulnerability on a website. This website allows users to create projects and name them. So I successfully injected an iframe on the naming function that can ...
Benassin's user avatar
2 votes
1 answer
231 views

Why we should not allow our pages to be loaded through Iframe by unknown hosts?

One of OWASP recomendations is to set the header X-Frame-Options to allow our pages to be loaded in Iframes only by sameorigin. One reason is because of phishing attacks, ok I understand. But if I ...
Vivi's user avatar
  • 69
1 vote
1 answer
667 views

preventing cross iframe key logging in javascript

We have a web application, where other partners can include their pages as iframes. We implemented a server-to-server way of authenticating users for the iframes, but one partner doesn't want to ...
peter's user avatar
  • 113
1 vote
1 answer
3k views

security issues related to setting cookie using an <img> tag

Site A will be having an <img> tag with src= attribute as an absolute URL pointing to site B. Site B will return an image response, and in that response a cookie will be set (cookie of Site B's ...
void's user avatar
  • 113
1 vote
1 answer
347 views

Will this sandbox my user's javascript from my web IDE properly?

I'm working on an IDE that should run a user's JavaScript in the Browser. I don't want to just eval arbitrary code, especially as code may be shared between users. From here and other sources, I ...
Silly Freak's user avatar
0 votes
1 answer
4k views

XSS in iframe can't access document cookies

I know of a website, lets call it website.com, that has these vulnerabilities: iframe injection: I can inject an iframe with a src attribute, but cannot inject any script directly. Lets say that this ...
Michael Hoefler's user avatar
1 vote
1 answer
340 views

PCI DSS SAQ A compliance with WooCommerce and 3rd party payment gateways - possible? [closed]

I am considering using Wordpress, WooCommerce, third party payment processor and different plugins for an ecommerce store. I have trouble figuring out if it is possible to do all that and to be PCI ...
elievi's user avatar
  • 11