Collaborate Disseminate
I am using x-frame-options sameorigin header to prevent some of my websites from being loaded in iframes. Is this a foolproof method to prevent iframe loading?
There have been several old threads on stackoverflow that discuss employing fra… Continue reading Is frame busting javascript required despite x-frame-options
I have an https website and I want to let other websites embed one of the pages on my website that lets users of my service log in and submit a form, similar to Paypal’s payment iframe or Plaid’s Link. Many such services exist, and from wh… Continue reading How to create a secure embeddable HTML form?
So this approach seems to be rather popular, particularly among payment processors that provide javascript integrations.
The added layer of security that "fields in iframe" brings also supposedly reduces the level of PCI complian… Continue reading How does collecting sensitive data using iframes increase security?
from what I understand a common approach to storing a CSRF token would be:
the client retrieves from the server a CSRF token
the token is stored in an input element inside the form like this:
<form>
<input type="hidden"… Continue reading cant a CSRF token be stolen using iframe?
We have an application which have purchased from a 3rd party and host in our own environment. The application consists of its own UI and back-end, and is included in our own application through an iframe.
During a recent scan by our securi… Continue reading Prevent XSS in 3rd party (self hosted) application
< iframe src="https://example.com" >
If i would have an account on example.com and would embed example.com on for example example2.com with an iframe as a little window, is it possible to be logged in with my example.com ac… Continue reading Is there a way cookies of a website, embedded in an iframe are used in the iframe?
During a credit card payment to site X , it asks me to login to my ebanking account through a frame in a site that handles that transaction in order to implement a more secure authentication (3d secure).
My question is : Should i trust suc… Continue reading Should i login to my ebanking account through frames in another website?
Very simply we have a ton of websites at our company behind SSO.
I am having a hard time figuring out what security issues there are if we open cross-site sharing between these sites but wanted to get a broader view. This is really a res… Continue reading Are there security issues around controlled cross site sharing behind SSO?
There are two different web applications Host and App which are hosted separatedly, i.e. in particular on different domains. App is not designed to be accessed directly. Rather users are expected to visit Host which embeds App as an IFrame… Continue reading Passing confidential data to an IFrame
I know that allowing site (especially login site) to be accessible by iframe is a bad practice. But I plan to use webView to "outsource" the login process in a mobile app to a website (owned and written by me), i.e. I’d load the … Continue reading Potential risk of allow login sites to be accessible through webview