Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

12
  • Depends on how you define “secure”, resp. who you actually want to hide it from. The user of your site can of course simply look in the source code, or check the network requests in the browser’s dev tools, and see that you are passing that value. Commented Apr 8, 2016 at 14:23
  • Plus, HTTP referrer might be an additional concern. If your page inside the iframe embeds any external resources, the full iframe URL might get send as referrer to a remote server. Commented Apr 8, 2016 at 14:24
  • are you using any server side language? Commented Apr 8, 2016 at 14:25
  • 2
    @Pete I've seen next solution $frame.on('load', () => $frame.contentWindow.init(token)). Is it secure? Commented Apr 8, 2016 at 14:36
  • 2
    This is really beyond specific Javascript functions or syntax. You're sending the token to the client browser. What exactly happens there is almost irrelevant. If there are any 3rd party scripts embedded in the site, they may have access to that token, because they have access to anything else in the DOM. Otherwise, you're as secure as you can be with any other sensitive information you pass to the client. Commented Apr 8, 2016 at 14:42