3 ms·
a question to iframe spec writters, why didnt they make everything secure by default? if i want to allow javascript in a iframe ,let me explicitly write it for
by camus 14y ago
a question to iframe spec writters, why didnt they make everything secure by default? if i want to allow javascript in a iframe ,let me explicitly write it for instance. if i want my content to be embedded in an iframe , let me explicitly allow it in my headers , etc ... wouldnt it make more sense ? rather than introducing more security holes and attack vectors ? third parties should have my explicit permission to embed my content into their site.
- homakov 14y agoi should borrow this text and put it in my blog tagline. as TL;DR.
- PommeDeTerre 14y agoFrames go back to the 1990s. Like a lot of the web technologies dating to that time period, the security implications of such functionality either weren't very well understood at the time, or weren't considered.