7

There are plenty of questions here where someone wants to load an OpenID provider's login page in an iframe rather than redirecting and having the provider control the entire look & feel of the login page. For very solid security reasons (primarily anti-phishing) this is a big no-no, prohibited, and most OpenID providers refuse to load within an iframe.

I have been presented with a situation where OpenID is being used within a single organization's set of web sites and applications. The OpenID provider has a whitelist of RPs and will only respond to those RPs. There is a desire to extensively customize the login page at the provider based on which RP sent the user to it. (If there are strong security arguments against doing this as well, I'd like to know about them as well.)

A proposed solution to this is to simply allow the RPs to present the login page in an iframe, so they can put whatever design around the login box they want. In this scenario only the "Username" "Password" fields and "Login" "Forgot Password" "Register New Account" buttons would be hosted at the Provider, the rest of the page would be at the RP and still have the RP's address in the title bar. Not optimal, yes, but the argument is that "it's a different subdomain, but the same 2nd level domain, so it's still okay."

I don't understand how this could be the case - having very different login pages for different applications still leaves users more vurnerable to phishing and other attacks. Am I incorrect in this conclusion? Every question on SO about this appears to be about using an external or public Provider, and the counterargument I'm encountering is that those concerns don't apply in a private Provider limited to sites on the same domain.

2 Answers 2

9

The general concerns about having OpenID within an iframe do have some validity even if you role your own provider. If any of your components are vulnerable to script injections there's a risk that they could compromise your users credentials since you could access iframe data from the parent window.

The normal recommendation to redirect (optionally in a pop-up) would limit this risk since the attacker now need to inject into the OpenID login page where you presumable have no script injections flaws.

1
  • 2
    Thanks. This is pretty much what I thought; good to have some confirmation. And thank you for answering an old question with no answers yet - it really helps StackExchange as a resource too.
    – Thaeli
    Commented Jul 18, 2012 at 18:18
2

Two years further on and I do not think that this is currently considered to be a bad idea, specifically because there is an OpenId Connect specification (currently at draft 21) which is detailing the process by which an iframe should be used to enable a RP to communicate with an OP in an iframe.

http://openid.net/specs/openid-connect-session-1_0.html

I don't know how long it is until this becomes ratified, but it does show that this is under consideration as a valid approach for managing sessions in a RP.

2
  • This answer is misleading and in the context of this question is wrong. OIDC SM is somewhat different from what OP asking for. It uses INVISIBLE iframes to check the state behind the scenes. It doesn't specify an iframe for entering credentials. Usage of an iframe for this use case should be avoided even in 2022. Commented May 30, 2022 at 20:52
  • @AntonBessonov is correct about the misleading context here - the reason for not using an iFrame is that is susceptible to click-jacking. If you want to read about it there is an IETF OAuth best practices document, it covers it: datatracker.ietf.org/doc/html/… Commented Oct 21, 2022 at 6:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.