4 ms·
Sounds like a good idea would be to somehow run the embeds in their own isolated container? Not sure how feasible that feature would be to implement.
by ilikehurdles 6y ago
Sounds like a good idea would be to somehow run the embeds in their own isolated container? Not sure how feasible that feature would be to implement.
- atombender 6y agoIndeed. Twitter, Instagram, and YouTube embeds all use iframes, so it should be entirely feasible to run these things in isolated containers.
- the8472 6y agoadding the sandbox, csp and referrerpolicy attributes to the iframe when it gets inserted to the DOM tree allows a lot of fine-grained control. Adding sandbox without allow-same-origin puts it into a null origin which makes the iframe isolated from all other origins which is similar to an ephemeral container. It might break CORS stuff though.