Hacker News new | ask | show | jobs
by josso 4623 days ago
Mike West, developer advocate at Google Chrome in Münich, had a great talk, recently at GOTO Aarhus, where this was mention. The talk was focused on security and mentions the new sandboxed iframes[1]. With the inline iframe, iframe's can now be used as div – a sandboxed div.

The idea is that you can sandbox e.g. social buttons by putting them in a sandboxed iframe. You can also populate the iframe's without extra HTTP-requests by the iframe, by using "srcdoc". This is a perfect way to sandbox user generated comments on your blog.

I recommend reading [1] as it covers all of this.

[1]: http://www.html5rocks.com/en/tutorials/security/sandboxed-if...

1 comments

But you can also just use a data: URI with the entire document inlined—gross, but no moreso than srcdoc. Why is srcdoc any better?