iframe an SSL secured form on a non SSL site

Question

I have a request in from a client that would like one of their existing forms present on another website.

They would like to have a payment form present in an iframe.

What, if any, implications are there when iframing in an SSL website into a non-SSL website when payment processing is concerned?

Answer 1

Your users' browser will give them security warnings that basically say this is an unsafe scenario. For example, a man-in-the-middle attack could inject javascript into your non-SSL page and now you are potentially compromised.

In this scenario, a popup or flat-out page redirect is the appropriate way to do this. As you are probably well-aware, you want 100% of content in your browser to be hosted via SSL in this sort of scenario. Otherwise, you simply are not guaranteed to be protected. That's the reason for those warnings.