Support

Admin Tools

#38698 Why are iFrames considered a security risk

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
4.2.8
PHP version
8.1
Admin Tools version
7.2.3

Latest post by tmichel on Tuesday, 14 March 2023 12:50 CDT

tmichel

I have heard Nicholas say that iFrames are not a good idea for displaying forms on a website. I am working on a client website and their forms provider JotForms told her that iFrames are a perfectly secure way for displaying form data on a website if that site is protected with an SSL certificate.

I would hate to go through all the trouble I have gone trough setting up Admin Tools just to add a vulnerability through some third party widget. She is a lawyer and her site deals in patients medical record, so her site needs to be HIPPA compliant which she can't afford, JotForms is HIPPA compliant, so she has to display their forms on her site through iFrames.is that a good idea or would she be better off in the long run getting a dedicated server so that she can make that server HIPPA and PCI compliant? Or should she just display a link to the form on the JotForms site?

nicholas
Akeeba Staff
Manager

You missed a crucial point: allowing any random URL (<-- that's the crucial point!) to load through an IFRAME on your site is a security risk. This could allow an attacker to inject an IFRAME which does all sorts of malarkey, such as clickjacking.

The “Protect against Clickjacking” feature —which I presume is what you are talking about— sends the HTTP header X-Frame-Options: SAMEORIGIN (MDN reference) to prevent that, but by doing so it prevent loading any off-site URL in an IFRAME. Since JotForms is a third party site it ends up getting blocked.

What you can do is disable this feature, enable Joomla's System - HTTP Headers plugin and set it up like so:

  • X-Frame-Options: Disabled (it does the same as Protect against Clickjacking)
  • Referrer-Policy: Disabled (already handled by the .htaccess Maker)
  • Cross-Origin-Opener-Policy: Disabled (already handled by the .htaccess Maker)
  • Force HTTP Headers: add a new record with these options:
    • HTTP Header: Content-Security-Policy
    • HTTP Header Value: frame-src 'https://*.jotform.com' 'https://sagacicweb.com' 'https://www.sagacicweb.com'
    • Client: Site

This tells the browser that IFRAMEs are allowed if their URL is either one from JotForms or your client's site.

As to HIPPA compliance, I am not a lawyer and I cannot tell you anything about it. Your client is the lawyer that can answer that.

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

tmichel

Working on week ends, aye! Thank you so much, I wasn't expecting a reply until Monday, but very much appreciate your taking the time to do this on Saturn Day, or Saturnalia Day.

I actually looked this up last night and realized the error of my understanding, you provided specific details, however that enhances and extend that understanding.

This is actually not for a Joomla site at all, I am trying to convert people to Joomla wherever I can and I hope by providing them information they wouldn't get from, whatever website company they are currently using they would be moved to switch to Joomla..

I will apply what you said to the Joomla sites I current;y manage, however, which I am sure will convince my clients to keep their subscriptions to Akeeba Admin Tools current.

the HIPPA compliance requirements are pretty much the same as PCI compliance. All the security features need to be in place on the server and website and the owner needs to apply for certification after that is accomplished. This requires a dedicated server or VPS, that costs $200/mo., minimum.

On the off-topic side, what do you think of Sam Altman and his perspectives on where the web is going? I can spin up a basic website including web-server, form scratch, using ChatGPT, pretty quickly these days. How is that going to affect the Joomla world? Or said in another way, how is that going to benefit Joomla? I am already using Git Copilot to fill in the blanks for me where Joomla coding is concerned. I mean it is giving me definitions of attributes to Joomla function that I have a hard time finding on the web, especially where Web Asset Manager is concerned. Not only does it fill in the options for me it also provides comments describing how the option is used.

 

tmichel

I want to say that looking at how your code implements ## Protect against clickjacking in .htaccess is simply amazing. If an imaginary baseball field had a thousand bases, you would have still covered all the bases. You do such incredibly good work. I can't recommend your components and plugins enough. No Joomla or WordPress website should ever be without Akeeba Admin Tools **Pro** or Akeeba Backup **Pro**.

nicholas
Akeeba Staff
Manager

Thank you :) This is very appreciated!

Nicholas K. Dionysopoulos

Lead Developer and Director

🇬🇷Greek: native 🇬🇧English: excellent 🇫🇷French: basic • 🕐 My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

tmichel

No problem, Nicholas, we need more people like you. Every website should have Akeeba Backup Pro and Akeeba Admin Tools Pro installed as a matter of what you do to create a professionally developed website.

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!