iFrame Security Risks from Embedding by Hacker

Question

Within my app (http://www.example.com) I am running an iFrame (https://www.example.com/iframe-application).

The main page (www.example.com) only renders custom data based on cookies set by the iFrame. The iFrame has all the smarts, the Javascript, the secure cookies, etc. The iFrame has NO text, images, etc. only javascript code.

Is there any risk that someone would embed the iFrame in another site and access secure cookies, login tokens, etc?

Answer 1

By default cookies are bound to the domain name, so in normal case that should not possible.

If you got a XSS Vuln. on your site, he could access the cookies, so rather be sure to escape all Inputstrings.

Answer 2

That would be a cross-site scripting attack and most browser will prevent it unless the user has configured them not to.