3 ms·
Right. But the main attack vector of a raw JavaScript include into the main page is that it can access anything you are doing in that page include logins or sec
by bhouston 4y ago
Right. But the main attack vector of a raw JavaScript include into the main page is that it can access anything you are doing in that page include logins or secrets or cookies or other private data. Moving it into an iframe sandboxes it and reduces the majority of nefarious things it can do. Especially if it is running off of web3dsurvey in the iframe and not the host website origin - thus a bunch of cross origin protections kick in.
So the iframe sandbox deals with the security issue is a different fashion.
Also the iframe can not block the main pages so it has even less impact on the main page experience.
This is as secure now as the majority of ads served on the web.