Questions tagged [iframe]
The HTML Inline Frame Element is a nested browsing context, embedding another HTML page into the current page.
91
questions
1
vote
0answers
47 views
Should i login to my ebanking account through frames in another website?
During a credit card payment to site X , it asks me to login to my ebanking account through a frame in a site that handles that transaction in order to implement a more secure authentication (3d ...
2
votes
0answers
40 views
Can this recommended OWASP framekiller code for protecting browsers that don't support X-Frame-Options be circumvented?
I have read and seen that javascript framekiller code doesn't seem to be widely espoused as a panacea solution. It's target use case seems to primarily be for legacy browsers or old browser versions ...
0
votes
1answer
108 views
Are there security issues around controlled cross site sharing behind SSO?
Very simply we have a ton of websites at our company behind SSO.
I am having a hard time figuring out what security issues there are if we open cross-site sharing between these sites but wanted to get ...
0
votes
0answers
55 views
Passing confidential data to an IFrame
There are two different web applications Host and App which are hosted separatedly, i.e. in particular on different domains. App is not designed to be accessed directly. Rather users are expected to ...
0
votes
0answers
33 views
Potential risk of allow login sites to be accessible through webview
I know that allowing site (especially login site) to be accessible by iframe is a bad practice. But I plan to use webView to "outsource" the login process in a mobile app to a website (owned ...
1
vote
0answers
59 views
Allowing 3rd-party cookies in major 2020 browsers [closed]
I'm trying to get 3rd party cookies to work on major mid-year 2020 browsers [1]. It's as simple as pointing an iframe to an external URL to make a cookied request and probably get the response ...
0
votes
1answer
126 views
What are the security risks of allowing users to add iframes?
In my web app I'm using a good sanitizer which let's me to whitelist some specific html tags.
I'd like to allow <iframe> so that users can insert youtube videos and so on.
However I'm worried ...
0
votes
0answers
54 views
Is it safe to embed a google form on a website without an SSL Certificate?
I designed a Google Form for a website which does not have an SSL Certificate. I have planned to embed it onto a page using an iframe tag. I am currently testing it and have published a test page with ...
0
votes
0answers
30 views
Security Benefits of Having a Content Security Policy for a Domain Loaded through iframe
Consider the below scenario:
There's a checkout webpage that can be accessed at checkout.example.com. This page has decent security policy. But just to prevent any credit card info leakage, credit ...
1
vote
1answer
107 views
User submitted iframes - what to watch out for?
I'm building a part of a site where users can embed Youtube videos into their profile. I'm planning to have them get the embed iframe from Youtube directly, and submit that to our server. We're then ...
1
vote
1answer
79 views
IFrame Vulnerability Classification
I was participating in a bug bounty on a website we will call example.com, when I ran into a very strange edge case which I am not sure I should report. The website uses ads and tracking similar to ...
0
votes
1answer
59 views
Does FB share button contain trackers?
I am considering putting a Facebook share button (shown below) on my website to encourage people to share content to their FB page.
However, I do not want cross site trackers "bloating" my website or ...
0
votes
0answers
57 views
Is “*.googleusercontent.com” used for internal services?
I am a bug bounty hunter. While searching for vulnerabilities in a private program, I saw a functionality that allows me to enter any code I want and it will execute them. Then I was thinking about ...
0
votes
1answer
290 views
WYSIWYG Rich text editor and renderer with no XSS risks
In our web app, we need to allow users to input rich text which is then presented to other users. We are looking for a simple WYSIWYG (JavaScript) editor that outputs a format which is backwards ...
0
votes
1answer
119 views
Assuming I own the client. Is it acceptable to embed my authorization servers login page in an iframe?
We have an authorization server which exposes a login page, we would like to authenticate users in our single page app using this authorization server. My employer does not want to redirect users to ...
2
votes
2answers
269 views
Can cross origin iframe be detected in web logs
A recent blog post shows hackers owning a web server - at least the content and injecting a web skimming attack. https://blog.malwarebytes.com/hacking-2/2020/03/criminals-hack-tupperware-website-with-...
4
votes
1answer
575 views
Is there any way to access the contents of a cross domain iframe
I found that a subdomain of a site leaks all cookies of the site due to improper error handling. Now, I found that this site does not have X-Frame Options Header in it. So, I put this subdomain in the ...
2
votes
1answer
122 views
Why we should not mix http and https when using iframes?
In the administration of advanced iframe I came across following:
"Please do not use a different protocol for the iframe: Do not mix HTTP and HTTPS if possible!".
Please explain the below points.
...
0
votes
0answers
90 views
Correct CSP frame-src value for iframes with empty src value
We have below CSP derivatives defined in our site,
script-src 'self' 'unsafe-inline' 'unsafe-eval' *.youtube.com; style-src 'self' 'unsafe-inline'; frame-src *.facebook.com www.youtube.com;
As ...
0
votes
1answer
118 views
Drive by download with iframes
Does the definition of a drive by download include malicious execution of an unaccepted downloaded file or is the unaccepted download of a file the drive by download by itself? I didn't find a good/...
0
votes
0answers
45 views
What to consider for determining something as a security flaw?
Recently, I found an iframe injection vulnerability on a website. This website allows users to create projects and name them. So I successfully injected an iframe on the naming function that can ...
2
votes
1answer
64 views
Why we should not allow our pages to be loaded through Iframe by unknown hosts?
One of OWASP recomendations is to set the header X-Frame-Options to allow our pages to be loaded in Iframes only by sameorigin.
One reason is because of phishing attacks, ok I understand. But if I ...
1
vote
1answer
208 views
preventing cross iframe key logging in javascript
We have a web application, where other partners can include their pages as iframes. We implemented a server-to-server way of authenticating users for the iframes, but one partner doesn't want to ...
0
votes
1answer
426 views
security issues related to setting cookie using an <img> tag
Site A will be having an <img> tag with src= attribute as an absolute URL pointing to site B.
Site B will return an image response, and in that response a cookie will be set (cookie of Site B's ...
1
vote
1answer
140 views
Will this sandbox my user's javascript from my web IDE properly?
I'm working on an IDE that should run a user's JavaScript in the Browser. I don't want to just eval arbitrary code, especially as code may be shared between users. From here and other sources, I ...
1
vote
1answer
1k views
XSS in iframe can't access document cookies
I know of a website, lets call it website.com, that has these vulnerabilities:
iframe injection: I can inject an iframe with a src attribute, but cannot inject any script directly. Lets say that this ...
1
vote
1answer
138 views
PCI DSS SAQ A compliance with WooCommerce and 3rd party payment gateways - possible? [closed]
I am considering using Wordpress, WooCommerce, third party payment processor and different plugins for an ecommerce store.
I have trouble figuring out if it is possible to do all that and to be PCI ...
1
vote
1answer
234 views
Why are js libraries designed to be loaded in iframe?
I am developing a JavaScript library which users would include in their website. a common theme across 3rd party libraries is that they are loaded in a n iframe. (ex you tube) . Is there any specific ...
1
vote
1answer
204 views
Why is not checking the origin of postMessage insecure?
Typically, within the onmessage handler, you would have something like this:
window.onmessage = function(e) {
if (e.origin != "www.example.com")
return;
//Do stuff
};
The check for e....
2
votes
0answers
188 views
iframes, user generated content and scripts
Currently, we have a small personal project which is meant to allow people to create 'profiles' in HTML/CSS. We aim to put all this generated content within a sandboxed iframe. The next point in ...
2
votes
1answer
758 views
Content Security Policy: postMessage into foreign iframe
Assume we have a webpage with sensitive data. The page uses a marketing partner advertisingpartner.com which collects data via third-party cookies in a foreign iframe. We have applied a relatively ...
1
vote
0answers
267 views
How to whitelist an iframe and script of some other source embeded/ called by an iframe that is whitelisted in the CSP?
For example I am having an iframe with src https://iframe1.com which is listed in my content security policy. If the whitelisted iframe calls some iframe from another source like https://iframe2.com, ...
2
votes
0answers
54 views
Collecting PII in an iframe on any website. Is it Safe?
I am building a chrome extension that allows users to submit a form on any website. Once a user would visit a certain website, extension would open iframe on that website and ask user for some PII in ...
1
vote
1answer
3k views
How to get the cookie of embedded iframe
I'm embedding an iframe on my site
< iframe id="demo" src="https://example.com" >
example.com has a cookie (not a http-only cookie)
How can I get the cookie?
15
votes
3answers
691 views
Are browser wrappers in software bad for users?
These days I see a lot of browser wrappers in software. For example:
when you purchase something in the Steam desktop application and use PayPal, you enter your PayPal security details in a browser ...
7
votes
3answers
14k views
Use XSS vulnerability in iframe to compromise parent?
I have a site, let's call it parent.com, that embeds a third party plugin from child.com in an iframe. I have found a XSS vulnerability on child.com.
The embedded page from child.com contains a form ...
5
votes
1answer
1k views
How do I control multiply-nested embedding of my iframe?
Domain example1.com embeds my iframe.
Domain example2.com embeds an iframe served from example1.com.
I would set X-Frame-Options: ALLOW FROM *.example1.com as well as Content-Security-Policy with ...
7
votes
1answer
5k views
What's the alternative of content security policy (CSP) header in Internet Explorer IE?
As mentioned in the Content Security Policy documentation & from the "supported browsers" page on the CSP site, CSP is not supported in Internet Explorer.
So, if we want to support CSP in our ...
1
vote
0answers
120 views
Protect website against attacks with iframe for user generated javascript?
I'm creating a small playground for people to write and test out their JavaScript on my website. I know websites like jsfiddle already exist but it's just for fun and for the sake of trying something ...
1
vote
1answer
2k views
Can website get hacked by iframe injection?
My website has been hacked. I am observing how hacker accesses my site. Though I have been using bindparam to prevent from sql injection and direct access restriction for backdoor attack, hacker's ...
1
vote
0answers
3k views
How to bust frame busting code without sandbox
Posted this on stackoverflow, but people are apparently scared of exploit code over there. I have the following index.html page that contains an iframe.
<body>
<iframe id="other" src="...
0
votes
2answers
33 views
HTTP request from Embeds Trackable
I'm pretty new here so please be gentle with me, a security newb.
I have a website where I want to have a user fill out a form. This form already exists on another website I own (that has greater ...
12
votes
1answer
48k views
How to confirm that an embedded iframe can read cookies from parent?
I have this html code that I may put on my site that we are evaluating for security purposes. It's code is essentially this:
<iframe src="https://glenpierce.github.io/" sandbox=
"allow-scripts ...
1
vote
1answer
129 views
Can malicious sites use session data from iframes?
Let's say I have logged in to my site Genuine Site. Malicious Site has an iframe embedding Genuine Site. Will the embedded iframe in the Malicious site have access to my login credentials from Genuine ...
0
votes
1answer
472 views
Website Security Breach from an Iframe
I know my website is being breached by a third-party web application under the following scenario:
My users put credentials to my site into a third-party web application
The third-party web ...
0
votes
1answer
2k views
Do we need to set the X-Frame-Options header for JS files too?
I have added the X-Frame-Options header for my HTML files from web server itself. Do I still need to add it for other static files like CSS and JS( which I serve from cloudfront/s3) ?
4
votes
1answer
143 views
iframe Checkout Procedure
I'm working for a company that wants to allow anyone to embed an iframe in which users can buy products on potentially any site. So it would be a typical use case for users to enter in their credit ...
6
votes
2answers
518 views
AVG detects Kaspersky update files as infected (trojan, infected, malware)
(Note: update at end of Q)
On a Mac, I am using AVG as the primary AV. In addition to this, I have a few scanners (Bitdefender and Malwarebytes) that I update and use periodically. Recently I decided ...
1
vote
1answer
95 views
Security questions - SSL secured payment iframe on an SSL secured site
Sorry if this has been answered before, I couldn't really find this exact example and I wanted to get a clearer answer for a client.
I understand that an iframe with a https payment portal on a http (...
1
vote
0answers
566 views
How does this XSS Payload work? [closed]
I recently found this payload on a security website. I tested it out and basically it just gave me a blank box. How does it work?
<iframe src=j
	a
		...
