Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Can someone shed some light on the rationale and usefulness of the inline "iframe" and "srcdoc" attributes? I read the description, I understand how they work, but I'm not sure what they are good for.


Mike West, developer advocate at Google Chrome in Münich, had a great talk, recently at GOTO Aarhus, where this was mention. The talk was focused on security and mentions the new sandboxed iframes[1]. With the inline iframe, iframe's can now be used as div – a sandboxed div.

The idea is that you can sandbox e.g. social buttons by putting them in a sandboxed iframe. You can also populate the iframe's without extra HTTP-requests by the iframe, by using "srcdoc". This is a perfect way to sandbox user generated comments on your blog.

I recommend reading [1] as it covers all of this.

[1]: http://www.html5rocks.com/en/tutorials/security/sandboxed-if...


But you can also just use a data: URI with the entire document inlined—gross, but no moreso than srcdoc. Why is srcdoc any better?




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: