Is it secure if we purchase through a website that is loaded in iframe

Question

I found one of the website is loading all shopping websites in their own domain.

Eg . www.domain.com having links like ,

www.shoppingsite1.com , www.shoppingsite2.com ,www.shoppingsite3.com ....

if we click on shoppingsite1.com it leads to www.domain.com/iframe/shoppingsite1

and loads the shoppingsite1.com inside this domain.

if some one purchase the product from shoppingsite1.com . Is it possible for domain.com to caputer all user data including payment credentials.

Bear in mind that this sort of configuration is widely required for 3rd-party payment systems. Payment processors will offer a checkout card details iframe to a different site in conjunction with tokenization to reduce the merchant's PCI scope. — gowenfawr, Oct 07 '13 at 13:38

score 1 · Accepted Answer · answered Oct 07 '13 at 12:24

1

No, as long as the CORS Access-Control-Allow-Origin is at its default restrictive value. This prevents the outer website from accessing the framed website via Javascript/etc.

CSRF attacks are still possible, though most sites protect themselves from this.

Note that you should be sure that the iframe is indeed on the correct domain (right click>view frame info on chrome) and is not being phished.

answered Oct 07 '13 at 12:24

Manishearth

8,257
5
35
56

So is it illegal to load some own's domains into another domain even or without their knowledge – Ragavendran Ramesh Oct 08 '13 at 04:56
@RagavendranRamesh Not in general, but some sites may have a content policy that disallows that. – Manishearth Oct 08 '13 at 05:18

score 1 · Answer 2 · answered Oct 07 '13 at 12:38

There are the issues Manishearth raised but also the possibility that as the site is loaded in an iframe they could overlay their own text fields over credit card input fields for example.

It's like a slight variation of a clickjacking attacking and whilst the host site isn't stealing data from the site they are framing, they're just tricking you into inserting it into the host site instead.

Is it secure if we purchase through a website that is loaded in iframe

2 Answers2

Linked