Are there any security concerns when putting an HTTPS iframe in an HTTPS page? Or security wise is it essentially the same as having a single HTTPS page.
(The iframe content is coming from a different domain if that makes a difference)
Share
Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
Are there any security concerns when putting an HTTPS iframe in an HTTPS page? Or security wise is it essentially the same as having a single HTTPS page.
(The iframe content is coming from a different domain if that makes a difference)
There are no on-the-wire privacy implications associated with this compared with a normal HTTPS page, but bear in mind that you’re doubling the number of servers and probably companies involved.
Browser exploits, popups and adware can all be served under HTTPS – and visiting a HTTPS site that isn’t in your control can expose your users to privacy violations if the HTTPS URL reveals personal information about one of your users – for example if you serve https://www.example.com/redir.php?url= + CURRENT_URL and you’ve logged in a user using a GET postback with the username and password in the URL, you could be exposing this to third party sites.
Other than that, there are no issues associated with embedding third-party HTTPS sites into your own HTTPS pages.