Per current security recommendations & browser support, is it okay to have an https iframe in an otherwise http-only set of pages?
Is this not a dupe? It is, but I want current trends because when I tested a few months back browsers warned me about mixed content, but now when I do an iframe of a secure login page overlay from my own domain I don't get any warning. (URL is a.com
but it points to my own local host, main url us http://a.com/
, which has an iframe that comes from https://a.com/login
)
I presume it's because https is not at fault and it was JavaScript that led to the vulnerabilities and now that is fixed?
Tested in FF 31, Chrome 36, IE 9
I did see:
- Specific risks of embedding an HTTPS iframe in an HTTP page ;
- Specific risks of embedding an HTTPS iframe in an HTTP page ;
- Is posting from HTTP to HTTPS a bad practice? ;
- https://www.owasp.org/index.php/SSL_Best_Practices
I understood that the risk is that the user could have an addon/malicious program that changes the iframe's source. If the user's computer is so badly compromised aren't all bets off anyway?
Should we tell our client, even in 2014, no https login iframe? If the user wants to login, refresh page to the https version or redirect the user to other login page and post login can come back to http in safe areas (non checkout and account related).
I know it's not much of a computational thing but for some reason the client is fixed on the idea that some pages are better http or https (default http though user can change to ssl manually)