Jump to content
Sign in to follow this  
moose-en-a-gant

can iframe sources be hijacked?

Recommended Posts

Sort of being lazy, I wanted to just embed the main inteface of my website in  a small window, rather than rescaling it.

So if I did <iframe src="mysite.com" width="auto" height='auto"> am I vulnerable for an attack eg. someone replacing the src with a different location. ?

Share this post


Link to post
Share on other sites

Usually iframes are safe if is your own content and the content being iframed has no security flaws in it.

If you want to prevent clickjacking you can use X-Frame-Options response header

 

When you iframe you lose a lot of control what you can do with it.

You are just adding a "window" of it. You can resize the frame but not the content within.

 

I would break the script up and include() it both places.

Another method would be to use file_get_contents()

Output buffering can be used to capture and store the data in the internal buffer and output it any way you want.

ob_start()

ob_get_clean()

ob_end_clean()

  • Like 1

Share this post


Link to post
Share on other sites

No that should be fine to do. An if the hacker is able to do what you describe we would probably just hack you mysite.com instead ;-)

Share this post


Link to post
Share on other sites

Well take adblock for example, I'm not sure how they work, I would like to think that they read the source and find code that matches advertisments like the format for google adsense and somehow re-write them like for example using jQuery setting display: to none; but I don't know if that is possible.

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Sign in to follow this  

×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.