视频iframe嵌入引发403最新的ios更新

Question

We run a website that displays embedded videos. The videos are embedded via an iframe. The iframe src only allows the referrer to be the website the video is being displayed on otherwise it throws a 403. The website is responsive. Since the latest IOS(9.3 and 9.3.1) updates if you refresh one on these pages the 403 gets thrown. This happens in safari and chrome. The embed iframe is controlled by checking an array of allowed referrers using PHP

In our tests users with an earlier version of IOS do not have the same problem.

Can anyone shed any light on why this might be happening?

Thanks

Matthew

Answer 1

This seems to be a bug in WebKit:

https://bugs.webkit.org/show_bug.cgi?id=155754

To workaround this, I'd suggest generating a random token in the 'outer' page, and appending it to the URL of the iframe (and saving it in a session or some other database). Then you could check whether an 'correct' token is sent.

While this requires you to have both pages (the video and the 'outer page') on the same server, this solution is more secure than referrer checking, as the user could send any string in the "referrer header".

Alternatively, simply skip the check for iOS 9.3 && 9.3.1, and hope that everybody upgrades to iOS 9.3.2 in the near future, which appears to have the bug fixed.