W3C home > Mailing lists > Public > public-html@w3.org > February 2009

Re: The <iframe> element and sandboxing ideas

From: Ian Hickson <ian@hixie.ch>
Date: Sat, 14 Feb 2009 23:40:32 +0000 (UTC)
To: Bill Lipa <dojo@masterleep.com>
Cc: public-html@w3.org
Message-ID: <Pine.LNX.4.62.0902142339180.28232@hixie.dreamhostps.com>
On Sat, 24 May 2008, Bill Lipa wrote:
> >
> > I've added a seamless="" boolean attribute to <iframe>, which, if the 
> > content's active document's URI has the same origin as the container, 
> > causes the iframe to size vertically to the bounding box of the 
> > contents...
>
> Seamless iframes sound quite excellent.  If the containing document 
> trusts the target iframe, could it opt out of the same origin check?  
> That would allow, for example, web services to provide better integrated 
> widgets.

With the postMessage() API, this is mostly unnecessary at this point. I 
think allowing that is better than having sites have to trust each other 
(it would be very easy if two sites trusted each other like that to spoof 
the DNS of just one on a local network and thus gain access to the data 
on the other).

-- 
Ian Hickson               U+1047E                )\._.,--....,'``.    fL
http://ln.hixie.ch/       U+263A                /,   _.. \   _\  ;`._ ,.
Things that are impossible just take longer.   `._.-(,_..'--(,_..'`-.;.'
Received on Saturday, 14 February 2009 23:41:10 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Wednesday, 9 May 2012 00:16:31 GMT