1

I'm not sure if this counts as an Information Security or Webmasters question rather than Programmers, however I'll see how we go.

I've been prototyping a help website for a particular browser game, and I've made the layout of the help website compact and concise with the idea that the rest of the page space can be filled with an iframe that will contain the game itself so players can also play while being on my website.

This way, players of the game can play the browser game and have access to all of the tools and information on my help website at the top of the page. The help website doesn't interact with the game inside the iframe of course, and its purpose is to provide useful references and calculators relating to the game.

I've done some research into the security of iframes, and how the website hosting the iframe can't interfere with the iframe due to the Same Origin Policy. The only security flaw I can think of for players is players not being sure that the real official browser game is running in the iframe and not a fake phishing copy.

What other security concerns should I be aware of and how can these be overcome either by me, the developer, or checked by users to ensure their security on my help website when playing the game via my help website? My main concern is players not feeling safe playing the game through an iframe on my website.

2
  • From a UX point of view iframes are discouraged. Have you seen an iframe rendered on a phone? Given the direction of browser penetration these days...not thinking about mobile is shooting yourself in the foot.
    – ArTs
    Feb 16, 2015 at 2:49
  • Mobile is something my help website doesn't seek to support, and the users will know that. More so I'm simply exploring the security risks to the player in playing the game via my site.
    – Edge
    Feb 16, 2015 at 3:03

1 Answer 1

1
+50

There are many well documented vulnerabilities and attacks that use frames.

OWASP has a good list of them here with examples:

https://www.owasp.org/index.php/Cross_Frame_Scripting

Generally, users should always be wary of any frame content especially Cross-Origin frames. Frames, including iframe, have undoubtedly been one of the largest vulnerabilities in the past and new vulnerabilities are found quite often.

A browser extension would be my ideal form of a "helper" that would integrate into the existing page, Chrome has a great engine and community for this.

That said, it is ultimately up to the user whether they trust you or not no matter how you handle it.

3
  • Many thanks. Out of curiosity, do chrome extensions allow you to create a toolbar for the extension? (like those old fashioned search engine toolbars for IE)
    – Edge
    Feb 17, 2015 at 21:41
  • They typically exist as a simple icon in the main toolbar, but can modify the pages the user visits to add additional info and toolbars in the page. This looks like a pretty good getting started: lifehacker.com/5857721/how-to-build-a-chrome-extension
    – AIDA
    Feb 17, 2015 at 22:02
  • I'd say the security risks for the users of a browser extension are the same as the risks using my current method. Chrome extensions can still do plenty of dubious things, and they can be just as untrustworthy as an iframe setup. Considering I'm not affiliated with the official makers of the game, I'm just another player trying to make players lives easier. A whole extension to do this would look even more suss and in theory give me greater power, regardless of the permission system of the chrome extensions. It's something I may consider, although then I'm limiting my 'apps' use to chrome.
    – Edge
    Feb 17, 2015 at 22:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.