English 中文(简体)
payment gateway (eWay) page in iframe - any security issues?
原标题:

I would like to use eWay (http://eway.com.au) as payment gateway but the problem is it doesn t allow much customization on their hosted page. I would like to display products client would be paying for but that is not possible so I thought maybe just whack hosted page into Iframe. But then again, I m expecting security issues with it, although couldn t exactly pinpoint what exactly could be the problem. I would be grateful if somone could give me a better idea if it would cause any security holes.

最佳回答

The problem with embedding an iframe from another website that is meant to be secure is that the users have no easy way to check that this website is the one they really want to talk to (your website could quite easily fake that iframe to be on one of your sites without them noticing: you could be the man in the middle, or someone between you and them could, if you re not using HTTPS on your site).

If the iframe points to an HTTPS site (most likely to be the case for payments), the users won t be able to check the lock or blue/green bar. It s possible to look into the source of the page to check the URI, but very few users know how to do this, even fewer will go that far.

(Note that, even if it s not a good idea, some big websites do this sort of things anyway.)

问题回答

暂无回答




相关问题
Signed executables under Linux

For security reasons, it is desirable to check the integrity of code before execution, avoiding tampered software by an attacker. So, my question is How to sign executable code and run only trusted ...

MALICIOUS_CODE EI_EXPOSE_REP Medium

I run findbugs against all of my code and only tackle the top stuff. I finally got the top stuff resolved and now am looking at the details. I have a simple entity, say a user: public class User ...

XSS on jsbin.com

Anyone know if jsbin.com implements any protection for XSS or other javascript attacks? I see jsbin links used fairly regularly on sites like this one and I can t find any indication from the site ...

Make md5 strong

Im making a website that will intergrate with game that only support md5 hashing metod (atm). Which ofc is not especially safe anymore. But how could i make it stronger? Should I just generate long ...

Why running a service as Local System is bad on windows?

I am trying to find out the difference between difference service account types. I tumbled upon this question. The answer was because it has powerful access to local resources, and Network Service ...

Brute-force/DoS prevention in PHP [closed]

I am trying to write a script to prevent brute-force login attempts in a website I m building. The logic goes something like this: User sends login information. Check if username and password is ...

热门标签