4 ms·

It's done to escape from iFrame jail attempts. Rogue site loads bank site in iFrame, end user types in their password...

• ams6110 9y ago
  Browsers are not supposed to let javascript access the DOM or events in a cross-domain iframe, is that not correct?
  • cpdt 9y ago
    Correct, but it's still possible for the parent page to overlay invisible textboxes and buttons in order to capture input.
    • chongli 9y ago
      Wow, what a tire fire the web has turned out to be. Can we just throw the whole thing out and start over? I miss the 90s...
• rypskar 9y ago
  Isn't it easier to set X-Frame-Options to deny or sameorigin?
  • duskwuff 9y ago
    Yes, absolutely. But that didn't work on some older browsers (like MSIE7 and earlier), so some sites settled on weird "solutions" like this one...
• TrickyRick 9y ago
  Why not implement a good 2FA then to avoid the problem entirely? The way I see it if someone can steal your bank login details using iframes as a weapon then the bank is doing something wrong. Banning pop-ups entirely would force the banks to shape up