3 ms·
The iframe sandboxing feature is better suited for this. It puts the full strength of the same-origin security policies of the browser between third party conte
by johncolanduoni 5y ago
The iframe sandboxing feature is better suited for this. It puts the full strength of the same-origin security policies of the browser between third party content and first party content on a domain. It has “only” been around since IE 10 or so though so it wouldn’t cover all of the golden age of flash.
It’s worth noting that Flash was actually quite hard to contain from interfering with your origin, and the main defense against this was that there were no sensitive APIs, cookies, or local data on the domains the flash was hosted from anyway.
- MrLeap 5y agoAh yeah that's a good idea. Assuming there's no reasonable way to do an iframe breakout, that is. I suspect any way I attempted to put this together, ner-do-wells would upload a game that adds upvote/like/subscribe/logout to every event handler. Now that I think about it, I can't remember any reason why I wouldn't be able to do that from inside actionscript.. I ran javascript from inside flash all the time.. The fact those flash sites didn't just unravel from shenanigans is pretty astounding in retrospect.