Hot answers tagged

29 votes

Why are iframes allowed by default?

Iframes are an important separation mechanism, which allow embedding of external content (like ads) into an HTML page in a restrictive way while still being able to interact with this content using ...
Steffen Ullrich's user avatar
26 votes

How to confirm that an embedded iframe can read cookies from parent?

First thing to note is that iframes (by default) don't act like they're part of the same origin, unless they are. If the iframe origin (in the src attribute) and the parent origin differ, the iframe ...
CBHacking's user avatar
  • 47.5k
20 votes
Accepted

How do I safely host third-party Javascript code in an iframe?

If the content you're embedding will contain untrusted scripts, it must either be loaded in an iframe from an untrusted domain, or be loaded from srcdoc in a sandboxed iframe with the allow-same-...
Ajedi32's user avatar
  • 4,743
15 votes

Would a hostname from an HTTPS iframe leak if loaded after a successful connection with another HTTPS hostname which displayed the iframe

I think you're asking: If the page at https://host1/ contains an <iframe> which loads https://host2/, does that mean the HTTPS connection to host1 somehow wraps the connection to host2? No. ...
Arminius's user avatar
  • 44.7k
15 votes

Why are iframes allowed by default?

As in many cases, it largely comes down to backwards compatibility. If Iframes were a brand new thing being created today, then they'd probably be opt-in rather than opt-out. But changing that now ...
Gh0stFish's user avatar
  • 10.1k
14 votes
Accepted

Is it safe to provide my details via an iframe, if the page in the iframe is secured with SSL?

It's a bad design and the entire page should use HTTPS, as this trains users to the unsafe practice of trusting and submitting private information over HTTP. It would be trivial for a man-in-the-...
dr jimbob's user avatar
  • 39.3k
11 votes

How does collecting sensitive data using iframes increase security?

... if a bad actor is able to run javascript on your page That's exactly the point one want to avoid. Iframes allow third-party sides including script to be part of the visible page without having ...
Steffen Ullrich's user avatar
10 votes

Would a hostname from an HTTPS iframe leak if loaded after a successful connection with another HTTPS hostname which displayed the iframe

In most cases some man in the middle which is able to passively inspect the traffic can find out the hostname of all sites accessed. This is because this information is contained in the TLS handshake ...
Steffen Ullrich's user avatar
9 votes
Accepted

How can I restrict my iframe to only use local content?

You can set a Content-Security-Policy header with the child-src directive. For example, this will only allow frame content from the same domain: Content-Security-Policy: child-src 'self' Instead of '...
Arminius's user avatar
  • 44.7k
8 votes

Is the Framekiller really safe against clickjacking?

In my opinion there's no such thing as a frame killer/buster script as JavaScript can be disabled in the <iframe tag, rendering your code useless. The best way to protect your application from ...
Jeroen's user avatar
  • 5,851
8 votes
Accepted

Use XSS vulnerability in iframe to compromise parent?

Iframes have a special tag called "sandbox" that sets how to treat the content of the iframe. Using that tag, you can granularly set permissions to allow an iframe to interact with the parent. ...
Nosajimiki's user avatar
  • 1,837
8 votes
Accepted

How to create a secure embeddable HTML form?

There's no really good way to do this. The problem is less clickjacking - though that is a risk - and more that the user has no way to know whether the frame is genuine, or a phishing site. Anybody ...
CBHacking's user avatar
  • 47.5k
6 votes
Accepted

Why don't web email clients put emails in an iframe?

TL;DR iframe cannot replace sanitization completely, but is a great feature to use as security in-depth. Unfortunately, it does get in the way of some user-friendliness features. I would be ...
700 Software's user avatar
6 votes
Accepted

X-Frame-Options Absent but cant load the page in iframe

The HTTP header Content-Security-Policy can be used to protect from loading the page in an iframe. In this case, its value is set to default-src 'self' *.xyz.com which means that only the current ...
Benoit Esnard's user avatar
6 votes
Accepted

What's the alternative of content security policy (CSP) header in Internet Explorer IE?

MDN - Content Security Policy (CSP) - Browser Compatibility shows what is supported in MSIE and what not. To summarize: MSIE only supports the sandbox flag MSIE only supports the old X-Content-...
Steffen Ullrich's user avatar
6 votes
Accepted

How do I control multiply-nested embedding of my iframe?

CSP frame-ancestors already does what you want. Content-Security-Policy: frame-ancestors [...] checks the entire ancestor chain. If any parent document doesn't match the source whitelist, your ...
Arminius's user avatar
  • 44.7k
6 votes
Accepted

How to get the cookie of embedded iframe

Assuming your site is not "example.com" (i.e. that this is a cross-origin iframe) and that there isn't a separate security vulnerability on example.com (such as cross-site scripting), you can't do ...
CBHacking's user avatar
  • 47.5k
5 votes

Malicious Software alert from US Department of Health and Human Services

Just by reading the first paragraph, I'm now 99.9% sure that this is a phishing mail. tl;dr: Ignore it.
thel3l's user avatar
  • 3,404
5 votes

Is it safe to provide my details via an iframe, if the page in the iframe is secured with SSL?

Since the iframe is over HTTPS but the main web page is HTTP; this would be mixed content but browsers would only give a warning if HTTP content is embedded in an SSL protected page, not the other way ...
Sandeep S. Sandhu's user avatar
5 votes
Accepted

Can malicious sites use session data from iframes?

No. A malicious site cannot interact with its iframes which point to other domains. It can only issue GET and POST requests without reading the corresponding responses, like any other web page opened ...
Enos D'Andrea's user avatar
5 votes

Can website get hacked by iframe injection?

Is my website hacked by iframe injection? No. Iframe injection means that an attacker has altered your site to load a malicious site's content into your page, carefully hidden. The injection refers ...
gowenfawr's user avatar
  • 72.8k
5 votes

How do I safely host third-party Javascript code in an iframe?

There might be many ways of achieving this, but I would most likely start with heavy handed input sanitization on server-side. For example: <iframe width="420" height="315" src=&...
CaffeineAddiction's user avatar
4 votes
Accepted

Is it a security risk that browsers can freely get images (and/or other resources) cross-domain?

Does that mean that if I have a "secret image" on Facebook (or any other resource with cookie session auth) any malicious site that I accidentally visit will be able to load that image in a hidden tag ...
Anders's user avatar
  • 65.5k
4 votes

Iframe inheriting parent's Content Security Policy

For 3, it seems there might be, and one that should allow you to set a tighter CSP on your other pages/content. According to https://www.html5rocks.com/en/tutorials/security/sandboxed-iframes/, you ...
iwaseatenbyagrue's user avatar
4 votes

How to avoid the cross-frame scripting attack over core php we application

Cross-frame scripting allows an attacker to embed your website within their own, as a frame/iframe and then spy on the users of your website. This requires some social engineering. An attacker would ...
Jedi's user avatar
  • 3,976
4 votes

Is there any security difference between login via iFrame, Pop-up, or redirect?

Iframes are dangerous as the user has no easy way of verifying that the embedded page is indeed, say, facebook.com and not some phishing page. Depending on how it is set up, allowing embedding might ...
user2428118's user avatar
  • 2,786
4 votes
Accepted

iframe Checkout Procedure

Is it possible to read information entered into an iframe like this through a keylogger or invisible divs floating on top of the iframe? Technically, the parent document can't capture a user's ...
Arminius's user avatar
  • 44.7k
4 votes
Accepted

XSS in iframe can't access document cookies

This bypasses the same origin policy, since the base-url is website.com, and script from evil.com is executed in website.com/iframeinjection. This is not correct. The open redirect vulnerability ...
Anders's user avatar
  • 65.5k
4 votes
Accepted

Does FB share button contain trackers?

Yes. For years, Facebook has been using its 'like' and 'share' buttons to collect data on users that visit sites where these buttons are installed. This enables Facebook to collect data on people ...
mti2935's user avatar
  • 23.1k
4 votes

How does collecting sensitive data using iframes increase security?

I'm writing this as an answer because a comment would be too long. But some time ago there was some malware that was used to infect some e-commerce websites, and the malware simulated a fake paypal ...
reed's user avatar
  • 15.8k

Only top scored, non community-wiki answers of a minimum length are eligible