Skip to main content

Questions tagged [iframe]

The HTML Inline Frame Element is a nested browsing context, embedding another HTML page into the current page.

Filter by
Sorted by
Tagged with
0 votes
1 answer
939 views

Why is not checking the origin of postMessage insecure?

Typically, within the onmessage handler, you would have something like this: window.onmessage = function(e) { if (e.origin != "www.example.com") return; //Do stuff }; The check for e....
Radvylf Programs's user avatar
2 votes
0 answers
327 views

iframes, user generated content and scripts

Currently, we have a small personal project which is meant to allow people to create 'profiles' in HTML/CSS. We aim to put all this generated content within a sandboxed iframe. The next point in ...
Lpuche's user avatar
  • 21
2 votes
1 answer
3k views

Content Security Policy: postMessage into foreign iframe

Assume we have a webpage with sensitive data. The page uses a marketing partner advertisingpartner.com which collects data via third-party cookies in a foreign iframe. We have applied a relatively ...
matoro's user avatar
  • 186
1 vote
0 answers
482 views

How to whitelist an iframe and script of some other source embeded/ called by an iframe that is whitelisted in the CSP?

For example I am having an iframe with src https://iframe1.com which is listed in my content security policy. If the whitelisted iframe calls some iframe from another source like https://iframe2.com, ...
Nani's user avatar
  • 11
2 votes
0 answers
169 views

Collecting PII in an iframe on any website. Is it Safe?

I am building a chrome extension that allows users to submit a form on any website. Once a user would visit a certain website, extension would open iframe on that website and ask user for some PII in ...
Sargis Plus Plus's user avatar
1 vote
1 answer
6k views

How to get the cookie of embedded iframe

I'm embedding an iframe on my site < iframe id="demo" src="https://example.com" > example.com has a cookie (not a http-only cookie) How can I get the cookie?
Doe's user avatar
  • 47
16 votes
3 answers
1k views

Are browser wrappers in software bad for users?

These days I see a lot of browser wrappers in software. For example: when you purchase something in the Steam desktop application and use PayPal, you enter your PayPal security details in a browser ...
luttje's user avatar
  • 163
10 votes
2 answers
30k views

Use XSS vulnerability in iframe to compromise parent?

I have a site, let's call it parent.com, that embeds a third party plugin from child.com in an iframe. I have found a XSS vulnerability on child.com. The embedded page from child.com contains a form ...
SecurityQuy's user avatar
7 votes
1 answer
3k views

How do I control multiply-nested embedding of my iframe?

Domain example1.com embeds my iframe. Domain example2.com embeds an iframe served from example1.com. I would set X-Frame-Options: ALLOW FROM *.example1.com as well as Content-Security-Policy with ...
Joshua Fox's user avatar
7 votes
1 answer
7k views

What's the alternative of content security policy (CSP) header in Internet Explorer IE?

As mentioned in the Content Security Policy documentation & from the "supported browsers" page on the CSP site, CSP is not supported in Internet Explorer. So, if we want to support CSP in our ...
Abhishek Sharma M's user avatar
2 votes
0 answers
258 views

Protect website against attacks with iframe for user generated javascript?

I'm creating a small playground for people to write and test out their JavaScript on my website. I know websites like jsfiddle already exist but it's just for fun and for the sake of trying something ...
Asperger's user avatar
  • 145
1 vote
1 answer
2k views

Can website get hacked by iframe injection?

My website has been hacked. I am observing how hacker accesses my site. Though I have been using bindparam to prevent from sql injection and direct access restriction for backdoor attack, hacker's ...
Dipak's user avatar
  • 113
1 vote
0 answers
3k views

How to bust frame busting code without sandbox

Posted this on stackoverflow, but people are apparently scared of exploit code over there. I have the following index.html page that contains an iframe. <body> <iframe id="other" src="...
123's user avatar
  • 235
0 votes
2 answers
97 views

HTTP request from Embeds Trackable

I'm pretty new here so please be gentle with me, a security newb. I have a website where I want to have a user fill out a form. This form already exists on another website I own (that has greater ...
Ryan Smith's user avatar
19 votes
1 answer
90k views

How to confirm that an embedded iframe can read cookies from parent?

I have this html code that I may put on my site that we are evaluating for security purposes. It's code is essentially this: <iframe src="https://glenpierce.github.io/" sandbox= "allow-scripts ...
Glen Pierce's user avatar
1 vote
1 answer
383 views

Can malicious sites use session data from iframes?

Let's say I have logged in to my site Genuine Site. Malicious Site has an iframe embedding Genuine Site. Will the embedded iframe in the Malicious site have access to my login credentials from Genuine ...
Souradeep Nanda's user avatar
0 votes
1 answer
592 views

Website Security Breach from an Iframe

I know my website is being breached by a third-party web application under the following scenario: My users put credentials to my site into a third-party web application The third-party web ...
user1609391's user avatar
0 votes
1 answer
4k views

Do we need to set the X-Frame-Options header for JS files too?

I have added the X-Frame-Options header for my HTML files from web server itself. Do I still need to add it for other static files like CSS and JS( which I serve from cloudfront/s3) ?
live_alone's user avatar
4 votes
1 answer
268 views

iframe Checkout Procedure

I'm working for a company that wants to allow anyone to embed an iframe in which users can buy products on potentially any site. So it would be a typical use case for users to enter in their credit ...
clarkatron's user avatar
6 votes
2 answers
838 views

AVG detects Kaspersky update files as infected (trojan, infected, malware)

(Note: update at end of Q) On a Mac, I am using AVG as the primary AV. In addition to this, I have a few scanners (Bitdefender and Malwarebytes) that I update and use periodically. Recently I decided ...
ahron's user avatar
  • 423
1 vote
1 answer
200 views

Security questions - SSL secured payment iframe on an SSL secured site

Sorry if this has been answered before, I couldn't really find this exact example and I wanted to get a clearer answer for a client. I understand that an iframe with a https payment portal on a http (...
Steve de Niese's user avatar
1 vote
0 answers
697 views

How does this XSS Payload work? [closed]

I recently found this payload on a security website. I tested it out and basically it just gave me a blank box. How does it work? <iframe src=j&NewLine;&Tab;a&NewLine;&Tab;&Tab;...
Dork's user avatar
  • 11
0 votes
1 answer
246 views

What Kind of Site Would I Need To DDOS

Recently I heard about Distributed Denial of Service and Denial of Service attacks and to see how this worked, I made a quick script (this is not a debug thing, I have an actual question about Cyber ...
The Gamer King's user avatar
3 votes
1 answer
2k views

X-Frame-Options Absent but cant load the page in iframe

I am trying to find the reason that a certain webpage is not getting iframed even when X-Frame-Options header is absent. Observation: When I write an HTML with iframe tag pointing to the URL and save ...
one's user avatar
  • 1,821
2 votes
1 answer
202 views

With HTTPS, can I reliable know client domain for authenticating them against my API

I am having a hard time coming up with the best title for this question, but let me explain my situation: I have a chat-room-as-a-service app similar to Intercom. Anyone can load the chat in an ...
max pleaner's user avatar
6 votes
2 answers
4k views

Is there any security difference between login via iFrame, Pop-up, or redirect?

There seems to be a number of techniques to authenticate a person on the web. Most commonly there are Javascript Pop-ups (Google, Firefox Persona, Disqus, etc) HTTP Redirects (OAuth, Facebook) ...
makerofthings7's user avatar
2 votes
4 answers
17k views

How to avoid clickjacking in HTML and Javascript

I tried to put the following code in HTML but it is not helping me avoid me the clickjacking: meta http-equiv="X-Frame-Options" content="DENY" I wrote the following code in Javascipt: if (self == ...
Shreya Srivastava's user avatar
1 vote
1 answer
3k views

Is the src of an iframe safe for user input?

<iframe sandbox="allow-scripts allow-same-origin" src="javascript:alert(1)"> I would like to know if the src attribute of an iframe is safe for user input ? I found this question, but my ...
Ced's user avatar
  • 189
2 votes
0 answers
3k views

Secure a page in iFrame from being used outside

In a secured area of a partner site we would like to embed an iFrame. The partner will generate a hash (accessToken) that will form a part of iFrame's src, e.g. <iframe src="our-domain.com?hash={...
Amio.io's user avatar
  • 153
1 vote
1 answer
623 views

what happens if browser doesn't support X-FRAME-OPTIONS

What happens if browser doesn't support X-FRAME-OPTIONS? Does it render the uri referenced by the iframe OR it doesn't render anything in this case?
Amio.io's user avatar
  • 153
6 votes
1 answer
5k views

How can I restrict my iframe to only use local content?

How can I restrict my iFrame to use only local (i.e. not from other websites) content? My question is the reverse of the question as how to restrict other sites from using my site in an iframe. I am ...
gordon613's user avatar
  • 291
0 votes
1 answer
3k views

x-frame-options header doesn't prevent showing site in iframe

For my site I see that among response headers there is X-Frame-Options: SAMEORIGIN. Still I can preview my site in iframe of some different site, for instance here. But I expected not to. I assume ...
Olena Horal's user avatar
3 votes
5 answers
416 views

Malicious Software alert from US Department of Health and Human Services

I have received a mail from a certain Security Incident Response Team on behalf of a US Department and it says, The below URL is currently being used to deliver a payload of malicious software to a ...
mapmath's user avatar
  • 141
6 votes
3 answers
11k views

How to avoid the cross-frame scripting attack over core php we application

I have developed one web application that is in core-php as per the client's requirement. My client conducted a vulnerability test, and found a Cross-Frame Scripting as a vulnerability at hard level. ...
Shaggie's user avatar
  • 161
8 votes
1 answer
8k views

Security about window.opener and iframes

I have 3 domains : domainA domainB domainC If I set target="_blank" on domainA with a link to domainC, domainC can access a bunch of property of domainA. That's why I use target="_blank" rel="...
Xavier59's user avatar
  • 2,904
13 votes
2 answers
8k views

Iframe inheriting parent's Content Security Policy

I have a parent page that has a Content Security Policy on it. The main purpose of CSP is not to prevent XSS, but to prevent network access. This page has to run some user generated/submitted HTML/CSS/...
tapananand's user avatar
0 votes
1 answer
496 views

Stealing client certificate using Cross Frame Scripting

An application asks for userID and then it asks for the client certificate to authenticate. All the pages of the application are vulnerable to XFS. Now an attacker can get userID using XFS, but can it ...
one's user avatar
  • 1,821
3 votes
1 answer
611 views

Is it a security risk that browsers can freely get images (and/or other resources) cross-domain?

Same origin policy protects us from malicious site manipulating the data on our trusted site by not allowing requests that would send the auth cookie e.g. But if I understand correctly images, scripts,...
Ilya Chernomordik's user avatar
2 votes
1 answer
7k views

Security of iframe vs Redirection [duplicate]

For a certain functionality, I can either 1. Redirect my user to a partner website. 2. or, Open up the partner's website in an iframe. Supposing the partner was malicious and/or easily hacked, ...
Chip's user avatar
  • 175
5 votes
2 answers
2k views

Dangers of including iframes in my website

I have a website say www.example.com. I include an iframe in www.example.com which loads a another page (say evil.example.net). What can the owner of evil.example.net do to attack www.example.com?
Chip's user avatar
  • 175
10 votes
2 answers
1k views

Why don't web email clients put emails in an iframe?

I figured clients like Gmail.com and Outlook.com would put emails into an iframe for extra security, but it turns out they sanitize heavily with something like Caja. But is there any particular ...
Greg Pete's user avatar
  • 123
3 votes
3 answers
3k views

Is it safe to provide my details via an iframe, if the page in the iframe is secured with SSL? [duplicate]

Visiting a streaming service I wanted to provide my payment details and was presented with a page that wasn't secured by HTTPS/SSL. I didn't provide my details and contacted support asking them to ...
Repox's user avatar
  • 163
0 votes
1 answer
598 views

Embedding a service subscription form (via iframe) in a landing page hosted by 3rd party - PCI DSS Complaince

We have a SaaS application which requires the user to submit payment info upon sign up. Subscription fee is charge monthly. And we have to be complaint with PCI DSS. Now, we are planning to use a ...
Stayman Hou's user avatar
1 vote
2 answers
7k views

How are iframes vulnerable to attacks

I have been doing some research as I am looking to implement a form on anther website using an iframe. I understand that an attacker can change the source code of an iframe to point to a script, but ...
bish's user avatar
  • 11
6 votes
2 answers
6k views

Cross domain iframe security

How exploitable is a site listening to browser messages from anyone? I am working on a site where I have found some iframe issues. The case is that site A has an iframe of site B, and site A listens ...
sboutzen's user avatar
2 votes
1 answer
2k views

To protect against clickjacking, is it safe to have a web page display its content until framing is detected?

Let's assume we have a web page that can't use X-Frame-Options, and the Clickjacking protection has to be JavaScript based. On this page, all sensitive actions and the display of sensitive information ...
kazhtaco's user avatar
2 votes
2 answers
730 views

Is it possible to trick a person into going to a website, and running JavaScript, without them knowing? (no iframes)

My website is W. If you make a GET request to my website, it gives you JavaScript, and if you execute the JS, then you do some action (if you are logged in and have a session cookie). Can someone ...
quantumtremor's user avatar
6 votes
3 answers
4k views

HTTPS iFrame embedded in HTTP page - PCI implications?

I'm currently volunteering at a nonprofit. While researching something unrelated, I noticed that a $sisteragency was using an embedded iFrame to accept online donations. While the frame's source uses ...
Sigvaldr's user avatar
3 votes
3 answers
567 views

Mitigating Login CSRF on 3rd party websites

I'm working on a project that requires to have a signup/login functionality exposed to partners who manage their own website. For some of these websites they reuse our own backend, and just change the ...
berdario's user avatar
  • 223
3 votes
2 answers
1k views

What kind of attack is when we use iframes to redirect users?

What is the name of the attack if: there is a forum on the goodwebsite.comm there is an attacker website badwebsite.comm The form on the goodwebsite.comm allows us to insert iframes, and using ...
Whythehell's user avatar