What's the difference between IFrame and Frame?

Question

Hello

Looking at options of embedding the 3D Secure page inside my own Order form, I came across the following:

"Some commerce sites will devote the full browser page to the authentication rather than using a frame (not necessarily an iFrame, which is a less secure object anyway)."

from http://en.wikipedia.org/wiki/3-D_Secure

Can someone give me the lowdown as to WHY iframes are less secure, and cause problems, as opposed to normal frames? And what's the basic difference?

The way I saw it, IFrame was the way to go?

Thanks Duncan

Answer 1

The only reasons I can think of is actually in the wiki article you referenced to mention a couple...

"The "Verified by Visa" system has drawn some criticism, since it is hard for users to differentiate between the legitimate Verified by Visa pop-up window or inline frame, and a fraudulent phishing site".

"as of 2008, most web browsers do not provide a simple way to check the security certificate for the contents of an iframe"

If you read the Criticism section in the article it details all the potential security flaws.

Otherwise the only difference is the fact that an IFrame is an inline frame and a Frame is part of a Frameset. Which is more layout problems than anything else!

Answer 2

The difference is an iframe is able to "float" within content in a page, that is you can create an html page and position an iframe within it. This allows you to have a page and place another doucment directly in it. A frameset allows you to split the screen into different pages (horizontally and vertically) and display different documents in each part.

Read

IFrames security summary

Answer 3

IFrame is just an "internal frame". The reason why it can be considered less secure (than not using any kind of frame at all) is because you can include content that does not originate from your domain.

All this means is that you should trust whatever you include in an iFrame or a regular frame.

Frames and IFrames are equally secure (and insecure if you include content from an untrusted source).

Answer 4

Iframe are used allot to include complete pages. When thoose pages are hosted on another domain you get problems with cross side scripting and stuff. There are ways to fix this ofc

Frames are used to divine your page in multiple part. Like for example a menu on the left.