Problem with redirect to https:// in frames

[Paul Schmidinger]

Hello,

I wrote a shop that redirects at some point to a https:// -webseite that is
responsible for the credit-card-stuff. Before redirecting, internet explorer
(and some other browsers) ask if it's OK to open the secure connection (many
people won't get the alert for they have clicked it away before). If you
confirm, redirect works and all is fine.

Now, someone uses the shop in a frameset. Frameset and navigation-frame are
on server A, shop in content-frame is on server B. Now the problem is: If
the content-frame sould redirect to the https-Website, there is NO alert
being displayed, and the redirect does not work (browser tries to access it
via https) => error from secure server.

I can live with that behaviour by avoiding the frames, but I am curious what
the reason is. Can it be called a "bug" of the browser? What is the reason
for reacting differently in that matter just because a page is in a frame?

Kind regards,
Paul Schmidinger
-- www.eigelb.at

 

[Toby Inkster]

I wrote a shop that redirects at some point to a https:// [...]
Now, someone uses the shop in a frameset [...] What is the reason
for reacting differently in that matter just because a page is in
a frame?

Javascript can be used to pass data from the "secure" frame to the
non-secure frame, which means the "secure" frame isn't really all that
secure at all!

Which is why most browsers will treat the framset as "insecure" overall
and won't do their normal HTTPS stuff, like displaying padlock/key icons,
etc.

 

[Paul Schmidinger]

Javascript can be used to pass data from the "secure" frame to the

non-secure frame, which means the "secure" frame isn't really all that
secure at all!

Which is why most browsers will treat the framset as "insecure" overall
and won't do their normal HTTPS stuff, like displaying padlock/key icons,
etc.

Thanks!