保护不同域中不安全页面上的 iframe
我们公司正在考虑允许第三方网站使用我们的在线结账系统。
一位客户表示，他们希望能够使用灯箱样式的弹出窗口来显示结账。 他们希望网站的每个页面都可以使用此功能，因此大多数页面都是不安全的。 我们的结帐系统和客户端站点显然位于不同的域。
我猜我可以使用安全的 iframe（使用 https）来显示我们的结账系统。
这个 iframe 真的安全吗？
这是明智的做法吗？ （我的直觉说不，因为用户如何判断页面是安全的）
是否有更好的方法来实现相同的功能？
Our company is looking into allowing third party sites to use our online checkout system.
A client has stated that they would like to be able to use a lightbox style popup to display the checkout. And they would like this to be available on every page of the site, therefore mostly unsecure pages. Our checkout system and the client site are obviously on different domains.
I'm guessing that I could use a secure iframe (using https) to display our checkout system.
Would this iframe actually be secure?
Is the a sensible thing to do? (my gut says no, as how can the user tell the page is secure)
Are there any better ways to achieve this same functionality?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
是的，iframe 是安全的，但您是对的，客户实际上无法知道它是安全的。 另一方面，大多数用户无论如何都无法判断页面是否安全 - 散布在周围的一些挂锁图像足以说服大多数用户。
当他们点击弹出结账时，您能否将他们发送到 HTTPS 下的同一 URL，然后将其弹出（当然，您需要自己的 SSL 证书）？
Yes, the iframe would be secure, but you're correct that the customer wouldn't actually be able to tell that it's secure. On the other hand, most users can't tell if a page is secure anyway - a few images of padlocks scattered around will convince most of them.
Could you, when they click to pop out the checkout, send them to the same url under HTTPS then pop it out (you'd need your own SSL certificate of course)?
您是否见过其他类似的结账系统是如何工作的？ 例如 ebay 上的 paypal 结账？ 他们会带您“全屏”完成结帐流程，并在交易完成后返回原始站点。
Have you seen how other similar checkout systems work? For example the paypal checkout on ebay? They take you trough the checkout process "full screen" and back to the original site when the transaction is complete.
我知道这是一个老问题，但我打算做同样的事情。 解决方法是要么执行 paypal 操作 -> 前往安全网站进行付款 -> 返回到返回网址。 或者，您可以使用一个非常通用的简短名称（例如 shop.com）（显然已被占用）来建立自己的网站，但该名称未被占用。
然后，您的客户可以拥有自己的空间，例如 https/www.theirsitename.shop.com，
所以他们会从 http/www.theirsitename.com 转移到上面。
大多数用户甚至无法知道他们已经转移到新网站，并且该页面将是安全的。
要获得他们的产品，您可以让他们从自己的一端发布它，也许还可以让他们发布一个 CSS 文件，这将完全改变布局，使其看起来像他们自己的网站。
I know this is an old question but I was planning to do the same thing. The work-around is either to do the paypal thing -> go to a secure site for payment -> return to return-url. Or you could set up your own website with a very generic, short name like shop.com (obviously taken) but one that is not taken.
Your clients could then have their own space like https/www.theirsitename.shop.com,
so they would move from http/www.theirsitename.com to the above.
Most users won't even be able to tell they've moved to a new website, and the page will be secure.
To get their products, you could make them POST it from their end, and perhaps also get them to POST a CSS file which would completely alter the layout so it looks like their own website.