Is it a bad idea to have a login dialog inside an iframe?

Posted by AyKarsi on Stack Overflow See other posts from Stack Overflow or by AyKarsi
Published on 2010-04-24T08:26:08Z Indexed on 2010/04/24 8:33 UTC
Read the original article Hit count: 263

Filed under:

iframe

|

authentication

We're creating a website where we will be giving out code snippets to our users which they can place on their own websites. These snippets contain a link a javascript include. When clicking the link, an iframe containing the login dialog to our site opens. The user then authenticates inside the iframe, does his work and when he leaves the iframe his session is closed. We've got it working allready and it's very slick.

Our main concern though is phishing. The user has absolutely now way of veryifying where the login page is really coming from. On the other hand, phising attacks are also succesfull even if the user can see the fake-url in the address bar.

Would you enter your (OpenId) credentials in an iframe? Does anyone know a pattern with which we could minimise the chances of a phishing attack?

© Stack Overflow or respective owner

Related posts about iframe

IE6 iframe anchor links moves iframe up

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi, Having a real head scratching moment... I have a site where there is a footer div that always sits at the bottom of the screen (26px high), and above that I have an iFrame which sizes to 100% of the remaining height. This works well. Even clicking on anchor links inside the iframe works as it… >>> More
Scripted iFrame loads contents over current page instead of within an iFrame

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm trying to load a webpage into an iFrame while keeping a content bar on top, but for some pages that I try to load into the iFrame the contents is loaded as if I navigated to that page. I use the following code to dynamically load an iframe: $('#my_iFrame').attr("src","http://www.nytimes.com/2010/03/26/opinion/26ryan… >>> More
Reloading iframe from another iframe

as seen on Stack Overflow - Search for 'Stack Overflow'
Can I reload iframe (say __tree_iframe) from another child iframe (__content_iframe)? Difficulty: IE6/7. UPDATE Obviosly I should use window.opener and find iframe using it iframes property. Apparently, IE doesn't support window.opener. Any ideas about another way? >>> More
IFrame targeting another IFrame

as seen on Stack Overflow - Search for 'Stack Overflow'
I have a parent page containing two iframes. One holds navigation links and the other should display the information pertaining to the navigation link clicked in the first iframe. So I need to target the one iframe from within another iframe.Is this possible? If so how does one go about it? >>> More
Reloading iframe from anpother iframe

as seen on Stack Overflow - Search for 'Stack Overflow'
Can I reload iframe (say __tree_iframe) from another child iframe (__content_iframe)? Difficulty: IE6/7. >>> More

Related posts about authentication

Configuring Fed Authentication Methods in OIF / IdP

as seen on Oracle Blogs - Search for 'Oracle Blogs'
In this article, I will provide examples on how to configure OIF/IdP to map OAM Authentication Schemes to Federation Authentication Methods, based on the concepts introduced in my previous entry. I will show examples for the three protocols supported by OIF: SAML 2.0 SSO SAML… >>> More
windows authentication vs sql server authentication for asp.net forms authentication site

as seen on Stack Overflow - Search for 'Stack Overflow'
I have a database and a site having forms authentication. It is working fine with VS2008. This time, I am using "Trusted_connection =True". But when it is opened from outside or directly from browser then I am getting error "Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'." I know this is due… >>> More
Disable authentication on subfolder(s) of an ASP.NET app using windows authentication

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi, Is it possible to disable windows authentication on one or more subfolders of an ASP.net application using windows authentication? >>> More
AutoCompleteExtender - authentication failure (forms authentication)

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm using the AutoCompleteExtender from the AJAX control toolkit on my aspx page - I have it wired up to a WCF service that is returning a string array and everything works happily. If I change my service definition to include a demand for the caller to be authenticated, like so: <OperationContract()… >>> More
Ruby on Rails , functionalities having twitter authentication and email authentication (autlogic and

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi Experts, I would like to ask your guidance on how to authenticate using email add/ the basic log-in while having also a twitter log-in, twitter authentication works fine but if having an alternative log-in like using basic sign-up and email log-in part wont work.... any ideas please...? >>> More