7

I have to pass authentication token from my website to my iframe in a secure way. My iframe is located on the same domain as my website.

Is it secure to pass auth token as parameter to iframe's src property? I mean:

<iframe src={"/purse/index.html?auth_token=" + token} />

UPDATE: By secure I mean that no-one except current (signed in) user have a chance to access the token.

P.S. In your answer pls also describe the way auth_token could be stolen with my approach

Improve this question
12
  • Depends on how you define “secure”, resp. who you actually want to hide it from. The user of your site can of course simply look in the source code, or check the network requests in the browser’s dev tools, and see that you are passing that value. Commented Apr 8, 2016 at 14:23
  • Plus, HTTP referrer might be an additional concern. If your page inside the iframe embeds any external resources, the full iframe URL might get send as referrer to a remote server. Commented Apr 8, 2016 at 14:24
  • are you using any server side language? Commented Apr 8, 2016 at 14:25
  • 2
    @Pete I've seen next solution $frame.on('load', () => $frame.contentWindow.init(token)). Is it secure? Commented Apr 8, 2016 at 14:36
  • 2
    This is really beyond specific Javascript functions or syntax. You're sending the token to the client browser. What exactly happens there is almost irrelevant. If there are any 3rd party scripts embedded in the site, they may have access to that token, because they have access to anything else in the DOM. Otherwise, you're as secure as you can be with any other sensitive information you pass to the client. Commented Apr 8, 2016 at 14:42

2 Answers 2

Reset to default
4

Technically an auth_token does not provide security, it provides identity. Security would be provided by your encryption and authentication system, usually SSL with some form of login. The auth_token is usually set after authentication and passed over an SSL encrypted connection back to the user. Based on the 'src' in the provided snippet, it appears to be to the same application space - no host info that would suggest a different host. If SSL is still being used to encrypt the connection, then there should not be a concern with anyone else 'seeing' that users auth_token.

Improve this answer
Sign up to request clarification or add additional context in comments.

Comments

0

The other answer is partially correct. Ultimately it is up to you to determine if the token is allowed to be viewed by others. In this situation, you are allowing that token to be public.

URLs are public and this includes the query parameters. So in this situation, the iframe is loaded and anyone can have access to that token. This includes, systems that log the URL, malicious JS on the page, and anyone snooping on network traffic. To securely pass the token you must include it in the signed part of the request, such as a header (and of course be using TLS or some other security mechanism).

Improve this answer

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.