Unfortunately auto resizing iframe without the opt-in of the embedded page could be used to snoop on private data using frame extents as a side channel. Imagine

Unfortunately auto resizing iframe without the opt-in of the embedded page could be used to snoop on private data using frame extents as a side channel. Imagine a page that is 10 times longer if you are signed into it-- a third party site you visit could use this fact to determine if you are signed into the embedded website, for instance, and they could make the frame invisible and you wouldn't even know it happened. While the embedding site can of course opt out of iframe embedding with X-Frame-Options, we can't assume that sites are built that way, and there may be legitimate use cases for iframing where you still don't want to expose the size of the underlying page. Things like pym.js and iframe-resizer are probably the best bet security wise as it requires opt-in by the underlying page.