Question

I’m building a PHP Web Application for Company A in which users can login and manage certain items in their inventory. I want to host this application myself for reasons such as maintenance, to make sure the servers meet expected performance standards and because Company B or C might also want the same service.

What Company A (B and C also) wants is to have this application be accesible from their a subpage on their domain. I’ve gone through possibilities of URL rewriting and linking, but i’ve decided to use iframes to display the application on their website.

I’ve used iframes before, but never when dealing with private data, so i’m not very familiar with the security risks attached to using iframes. A lot of the examples i found after googling were risks attached to hackers adding iframes with their own destination to existing code, as opposed to harmfully use an existing one. What should I look out for and try to prevent from happening?

In case im completely off with this, what other method could i use instead of iframes? Given the above-mentioned requirements of course.

Answer 1

To start, your best solution is probably to use a subdomain pointing to your server hosting the app. So Company A can have their regular web site on companya.com but have the application on app.companya.com.

Regarding frames, I don’t think in your situation there are any security “risks” to worry about. The iframe will belong to you and you control it. Javascript’s Same Origin Policy prevents frames on different domains (and subdomains unless document.domain is set) from accessing each other. So the iframe won’t be able to access the parent and vice-versa.

However I’m assuming the application is free standing and doesn’t rely on anything from the parent site. In which case, everything would happen in the frame and there’s no need for the frames to communicate in any way.

The disadvantage of frames of course is that the apparent URL and page title will remain the same when you load new pages in the iframe, which is bad usability (and bad for SEO, if that is a concern).