3 ms·
It's a little contrived, but a "practical" use of this might be for an online HTML editor to embed the document (or display a preview) without any interference
by heydenberk 12y ago
It's a little contrived, but a "practical" use of this might be for an online HTML editor to embed the document (or display a preview) without any interference from the parent document.
- schrodinger 12y agoYou can do that via iframe as well
- leorocky 12y agoIf you allow custom HTML via an iframe and make it shareable you have to host the iframe from a different domain, otherwise it's XSS vulnerability heaven. The trick will be authentication because separate domains don't share sessions (and you wouldn't want a secured domain access to your session anyway) but you can do communication via postMessage.