iFrame
iFrame
At this moment it is not recommended to display the PayPal page in an iFrame. With Medium (default)
security settings in several browsers, like Internet Explorer and Safari, it results in the shopper seeing a security
warning or error page.
Figure 6: PayPal security warning/error message
The reason for this is that pages in the iFrame are marked as third-party (compared to the parent window).
When these sites want to work with a cookie, browsers can act upon this (Allow third party cookies). The
PayPal pages are even a bigger threat since they lack a so called P3P header
(http://en.wikipedia.org/wiki/P3P). This header indicates what kind of info is stored / requested by the website
via a cookie and this is compared with the browsers risk settings. It is therfore no guarantee that a cookie is
accepted when a P3P header is being sent, but it allows the browser to verify in detail if there is no sensitive
data shared.
Adyen is adding functionality on the Hosted Payment Pages that offers automatic functionality that tells the
payment page to "break" out of the iFrame before redirecting to PayPal. Since PayPal is then displayed in the
browser's address bar it is no longer a third party and there are less issues with cookies.
Please note that cookies can be disabled completely in browsers. In this case various payment methods like
PayPal and iDeal are not working anymore. For more information on iFrames or the latest state on the Adyen
feature addition, please refer to the “Using an iFrame” section in Chapter 1 of the Adyen Integration Manual.
Copyright © Adyen B.V. 2010-2011 11
