CSRF protection question

Question

I'm currently in the process of implementing CSRF protection into my framework (PHP).

However I am wondering:

Wouldn't it be possible for an attacker to load my page in a (hidden) iframe (obtaining the token) and change some data using JavaScript?

And after that submitting the form?

Answer 1

Unless the attacker's page has the same domain, protocol and port as yours (if it is, you probably have more serious problems), they won't be able to read the iframe's HTML because of Same Origin Policy.