3 ms·
The method PayPal is using right now, the one mentioned in the article, utilizes iframes. > The iframe itself should have its own non-editable URL address bar
by idbehold 12y ago
The method PayPal is using right now, the one mentioned in the article, utilizes iframes.
> The iframe itself should have its own non-editable URL address bar
This would definitely be good for security, but I feel like it would probably be overkill for many other iframe use cases. Think about every YouTube embed having an address bar. And what about the "hidden" iframes that are only 1x1, do you still show an address bar? Do you set a minimum size for iframes?
- spartas 12y agoObviously there would need some additional thought put into this. It might be a net-positive for every YouTube embedded video to have an address bar (copy from the iframe url and paste the embed URL into the browser's address bar, YouTube could detect that it's not being loaded into a frame and take the user to the standard video page). As far as the 1x1 and minimum frame size, I don't know. 1x1 iframes are usually hidden (is there any point to having them visible?). I don't think it's a specification's place to enforce minimum size limits for elements (frames or otherwise). Perhaps the user agent could display a button that the user could interact with if the iframe size were smaller than a certain size.
- wlesieutre 12y agoAnd would be trivial to spoof by just drawing your own address bar. Bonus points for detecting browser/OS and drawing the appropriate version. The certificate verification UI in browsers only works because it's outside of the area that a website could display a fake one in. You'd need some kind of indicator tied to the iframe from outside the web view, otherwise they'll end up like the ads that looks like popup windows to trick you into clicking the close button.