0

Is it safe to embed a webpage inside another webpage with external origin.

User can also choose what webpages to embed, and it could be anything, valid webpage.

Can those webpages access my document? manipulate javascript and does it have some XSS vulnerabilities?

Generally I'm interesting if it is safe, or if there is a way to secure it.

iConnor
  • 19,997
  • 14
  • 62
  • 97
CBeTJlu4ok
  • 1,072
  • 4
  • 18
  • 51

1 Answers1

4

They cannot access your document. You cannot access their documents either.

The only 'dangers' are:

I don't recommend doing it! Especially not if users can share their own included sites.
Even if the external sites do not contain viruses, these sites are (from a user's perspective) on your site and can affect your reputation.

Community
  • 1
  • 1
ComFreek
  • 29,044
  • 18
  • 104
  • 156
  • I can bear with popups and alerts as they appear only in users page, but what about viruses? virus for my site or just a user virus? – CBeTJlu4ok Oct 26 '13 at 18:09
  • @Mpa4Hu Only a 'virus' for the users. Note that the alerts() will appear on the whole tab or window. /Connor: I've added two links. – ComFreek Oct 26 '13 at 18:10
  • **Thanks all upvoters** - I'm now a 10k rep user :-) – ComFreek Oct 26 '13 at 20:01