How do I "secure" the source to an iframe to prevent "hotlinking"?

[OrganizedFellow]

Hiya friends!

A friend running his website on SquareSpace wants to link to a PHP form via iframe. SquareSpace does not allow/support PHP, I guess?

https://answers.squarespace.com/questions/64124/linking-to-externally-hosted-php-form.html

So I help my friend out and have it working as needed.

 

I've not used iframes since the days of pixel precise table layouts

Should I be concerned with some how securing the iframe source to prevent hotlinking or something?

 

For simple testing, I have the page here: http://www.jjaleman.com/thm/

If you view the source, you will see the iframe src is http://www.jjaleman.com/thm/rewards.php

 

How can I make sure (100%) that the rewards.php scripts is ONLY being called from my client URL?

[arjen]

Hi, it is pretty much impossible to 100% secure it since most stuff can be (easily) spoofed. If the content is publicly accessible it's possible to access it. That's the baseline rule of internet content security. You can of course build some barriers to make it harder.

There are several options to throw up some barriers:

1. JavaScript checking the parent hostname (this can be spoofed)
2. Mess around with the referer stuff in .htaccess (can be spoofed too)
3. Check how ProcessWire denies its access to other iframe

My opinion: you can throw as many barriers as you like, but especially the people who want access are the people to know and overthrow the barriers you build. Do

[pwired]

There exist a lot of htaccess rules for that.

Example:
Header set X-Frame-Options DENY
Header always append X-Frame-Options SAMEORIGIN

https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options

[kixe]

By default you cannot frame a page running under PW from other domain, because X-Frame-Options is set to SAMEORIGIN

In your case you could change the directive to X-Frame-Options ALLOW FROM {uri}
Unfortunately this is not supported in all browsers (Chrome?). You have to try out.

Maybe best solution is to move to a host which supports PHP and PW of course.

 

[OrganizedFellow]

Maybe best solution is to move to a host which supports PHP and PW of course.

He's quite happy with the service he is using.

I built a site for him years ago when I used ExpressEngine, and he liked it!

Maybe I can convince him later