CODEWITHSUNDEEP
iframex-frame-optionsonlinebanking3d-secure
Ashok
Ashok

Reputation: 531

Does 3D secure and net banking sites use x-frame-options header?

I am trying to embed 3D secure and net banking pages in an IFrame, and I am able to achieve it successfully for a few sites which I have tested. But I suspect if ALL the bank pages will open in IFrame.

What if any bank has set x-frame-otpions to SAMEORIGIN or DENY?

Tried searching for a tech spec regarding this, but couldn't find anything.
Is there a common thumb rule or convention (in any spec) that an authenticating bank should/shouldn't use this header? How do I believe if this will work for all the banks?
Any clarifications would be of great help.

P.S.: I know there are other ways of opening the authorization gateways. But still, I need clarity on this approach.

Upvotes: 10

Views: 1659

Answers (1)

baszak
baszak

Reputation: 456

You typically wouldn't just open an iframe with the bank domain. Instead you open an iframe from an outside payments' provider domain(adyen, braintree etc.) and they, in turn, open another iframe inside so that they only have to allow payments' providers iframe to communicate with it.

What's interesting that those iframes still usually have same-origin policies.

Upvotes: 0

Related Questions