Iframe Sandbox - Revision history

Wesleyhales: /* use cases */

2011-11-01T20:35:30Z

use cases

← Older revision		Revision as of 20:35, 1 November 2011
Line 52:		Line 52:
	* gadgets		* gadgets
	* ads		* ads
			* [http://community.jboss.org/people/wesleyhales/blog/2011/08/28/fixing-ajax-on-mobile-devices AJAX]

	Examples? Could someone provide code examples of how <iframe sandbox> could be used for gadgets or ads or other use cases?		Examples? Could someone provide code examples of how <iframe sandbox> could be used for gadgets or ads or other use cases?


			== Gadgets ==
	Not a full worked example, but embeding an gadget like this, in combination with postMessage, is safer than a vanilla iframe:		Not a full worked example, but embeding an gadget like this, in combination with postMessage, is safer than a vanilla iframe:

Line 64:		Line 67:

	If the allow-same-origin flag is left off, then the gadget can even be hosted on the same site as the embedding content, but would still be isolated from DOM access and network access to the site's resources. In this case it would need to be used in combination with srcdoc or with the text/html-sandboxed MIME type to give sound security.		If the allow-same-origin flag is left off, then the gadget can even be hosted on the same site as the embedding content, but would still be isolated from DOM access and network access to the site's resources. In this case it would need to be used in combination with srcdoc or with the text/html-sandboxed MIME type to give sound security.

			== AJAX ==
			In the [http://community.jboss.org/people/wesleyhales/blog/2011/08/28/fixing-ajax-on-mobile-devices link above], we have a way of parsing and storing an AJAX responseText with a sandboxed iframe. This proposal is working around the usage of innerHTML, which is [http://martinkou.blogspot.com/2011/05/alternative-workaround-for-mobile.html causing problems] on iOS/Mobile Safari devices.

	[[Category:Proposals]]		[[Category:Proposals]]

Annevk: categorize

2011-01-26T12:22:36Z

categorize

← Older revision		Revision as of 12:22, 26 January 2011
Line 64:		Line 64:

	If the allow-same-origin flag is left off, then the gadget can even be hosted on the same site as the embedding content, but would still be isolated from DOM access and network access to the site's resources. In this case it would need to be used in combination with srcdoc or with the text/html-sandboxed MIME type to give sound security.		If the allow-same-origin flag is left off, then the gadget can even be hosted on the same site as the embedding content, but would still be isolated from DOM access and network access to the site's resources. In this case it would need to be used in combination with srcdoc or with the text/html-sandboxed MIME type to give sound security.

			[[Category:Proposals]]

Mjs: /* use cases */

2010-08-26T02:46:28Z

use cases

← Older revision		Revision as of 02:46, 26 August 2010
Line 54:		Line 54:

	Examples? Could someone provide code examples of how <iframe sandbox> could be used for gadgets or ads or other use cases?		Examples? Could someone provide code examples of how <iframe sandbox> could be used for gadgets or ads or other use cases?

			Not a full worked example, but embeding an gadget like this, in combination with postMessage, is safer than a vanilla iframe:

			<source lang=html>
			<iframe sandbox="allow-scripts allow-same-origin" src="http://external.server.com/gadget.html"<</iframe>
			</source>

			It prevents the framed content from being able to navigate the top level, among other things.

			If the allow-same-origin flag is left off, then the gadget can even be hosted on the same site as the embedding content, but would still be isolated from DOM access and network access to the site's resources. In this case it would need to be used in combination with srcdoc or with the text/html-sandboxed MIME type to give sound security.

Mjs: /* examples in the wild */

2010-08-26T02:37:41Z

examples in the wild

← Older revision		Revision as of 02:37, 26 August 2010
Line 45:		Line 45:

	Which content? URLs to examples in the wild?		Which content? URLs to examples in the wild?

			- At one point, <iframe sandbox> was used by Google Image Search to prevent framebusting by enframed content. However, I believe it is currently disabled since it prevents plugins from working.

	=== use cases ===		=== use cases ===

TheresaOConnor: -1

2010-08-14T04:04:14Z

-1

← Older revision		Revision as of 04:04, 14 August 2010
Line 22:		Line 22:
	* -1 [http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2010-August/027485.html Adam Barth]		* -1 [http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2010-August/027485.html Adam Barth]
	* -1 [http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2010-August/027491.html Maciej Stachowiak]		* -1 [http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2010-August/027491.html Maciej Stachowiak]
			* -1 [[User:EdwardOConnor\|EdwardOConnor]] - While I'm put off by the syntax (markup in attribute values looks quite gross), I think the feature is needed and the design certainly meets the need.
	* ...		* ...

Tantek: /* use cases */ t

2010-08-03T20:16:37Z

use cases: t

← Older revision		Revision as of 20:16, 3 August 2010
Line 46:		Line 46:

	=== use cases ===		=== use cases ===
	[http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2010-August/027491.html Per Maciej]j, while it's unclear if <iframe sandbox> will work well for comments or other such cases of seamless untrusted content, it seems clearly useful for use cases like:		[http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2010-August/027491.html Per Maciej], while it's unclear if <iframe sandbox> will work well for comments or other such cases of seamless untrusted content, it seems clearly useful for use cases like:
	* gadgets		* gadgets
	* ads		* ads

	Examples? Could someone provide code examples of how <iframe sandbox> could be used for gadgets or ads or other use cases?		Examples? Could someone provide code examples of how <iframe sandbox> could be used for gadgets or ads or other use cases?

Tantek: /* opinions and discussion */ ...

2010-08-03T20:16:11Z

opinions and discussion: ...

← Older revision		Revision as of 20:16, 3 August 2010
Line 22:		Line 22:
	* -1 [http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2010-August/027485.html Adam Barth]		* -1 [http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2010-August/027485.html Adam Barth]
	* -1 [http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2010-August/027491.html Maciej Stachowiak]		* -1 [http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2010-August/027491.html Maciej Stachowiak]
			* ...

	== why sandbox should be kept ==		== why sandbox should be kept ==

Tantek: added comments from Adam and Maciej in email, documented in section to keep the sandbox attribute

2010-08-03T19:05:05Z

added comments from Adam and Maciej in email, documented in section to keep the sandbox attribute

@@ Line 5: / Line 5: @@
 This page is for collecting issues and proposals related to the new <code>&lt;iframe&gt;</code> <code>sandbox</code> attribute.
-== sandbox attribute should be dropped ==
+== proposal drop sandbox attribute ==
 The new 'sandbox' feature on <code>&lt;iframe&gt;</code> should be considered for removal.
@@ Line 17: / Line 17: @@
 — [[User:Tantek|Tantek]] 01:56, 2 August 2010 (UTC)
-Opinions / discussion:
+=== opinions and discussion ===
 * +1 [[User:Tantek|Tantek Çelik]]
-* ...
+* -1 [http://lists.whatwg.org/htdig.cgi/whatwg-whatwg.org/2010-August/027484.html Ian Fette]

Tantek: drafted

2010-08-02T01:56:23Z

drafted

New page

{{stub}}

= iframe sandbox attribute =

This page is for collecting issues and proposals related to the new <code><iframe></code> <code>sandbox</code> attribute.

== sandbox attribute should be dropped ==

The new 'sandbox' feature on <code><iframe></code> should be considered for removal.

In speaking with fellow developers at Mozilla, I've collected the following feedback:

* The sandbox feature and functionality needs a thorough security review.
* It will be a lot of work to implement properly.
* It may not actually solve the problem it is intending to solve.

— [[User:Tantek|Tantek]] 01:56, 2 August 2010 (UTC)

Opinions / discussion:
* +1 [[User:Tantek|Tantek Çelik]]
* ...