CSRF protection question

Question

I'm currently in the process of implementing CSRF protection into my framework (PHP).

However I am wondering:

Wouldn't it be possible for an attacker to load my page in a (hidden) iframe (obtaining the token) and change some data using JavaScript?

And after that submitting the form?

Tacita

Answer 1

Unless the attacker's page has the same domain, protocol and port as yours (if it is, you probably have more serious problems), they won't be able to read the iframe's HTML because of Same Origin Policy.

Aceves

Ok kewl. I thought the Same Origin Policy only meant we couldn't do requests. – Tacita

@PeeHaa: It depends on the context. With an iframe, it means unless the domain, port and protocol match, you can not access the iframe's DOM. – Aceves