3 ms·
Indeed. Twitter, Instagram, and YouTube embeds all use iframes, so it should be entirely feasible to run these things in isolated containers.
by atombender 6y ago
Indeed. Twitter, Instagram, and YouTube embeds all use iframes, so it should be entirely feasible to run these things in isolated containers.
- the8472 6y agoadding the sandbox, csp and referrerpolicy attributes to the iframe when it gets inserted to the DOM tree allows a lot of fine-grained control. Adding sandbox without allow-same-origin puts it into a null origin which makes the iframe isolated from all other origins which is similar to an ephemeral container. It might break CORS stuff though.