Learn More
Resend Email
1
pythonPlusPlus
3y

Fuck social media websites that don't allow you to embed their content with a simple iframe

Good example 👍 :
<iframe src="https://youtube.com/embed/..." allow="..." allowfullscreen></iframe>

Bad example 👎:
<blockquote class="reddit-card" ...><a href="https://www.reddit.com/r/.../...">...</a></blockquote>
<script async src="//embed.redditmedia.com/widgets/platform.js"></script>

NO I DON'T WANT TO RUN YOUR 100kb JAVASCRIPT FILE WITH FULL PERMISSIONS ON MY WEBSITE JUST TO DISPLAY 1 SENTENCE AND 1 IMAGE. WHO KNOWS WHAT OTHER NASTY THINGS IT MIGHT LOAD IN IN THE FUTURE.
With an iframe it's at least somewhat contained.

rant

js

iframe

embed
Favorite
Ranter
Comments
  • 3
    3y
    I think there are some cookie-related issues for them in using iframe, They won't be able to properly track the views and stuff in an iframe.

    YouTube does count views in embedded videos, not sure how.
  • 0
    3y
    100kb of js you say?
  • 1
    3y
    There's a security reason why you use X-Frame-Options to forbid other sites to iframe your site, that being clickjack attacks:

    https://troyhunt.com/clickjack-atta...
  • 1
    3y
    @Fast-Nop One can write an "embedding area" (like YouTube did) where the possibility of clickjacking does not benefit the attack.
  • 1
    3y
    @sbiewald YT is an exception because videos are not an actual UI anyway.

    Otherwise, there's usually no reason why you would even want a third party site to iframe your content instead of setting a hyperlink.

    I set both X-Frame-Options and the frame-ancestors part of my Content Security Policy to prevent such third party iframing.
Related Rants
devRant © 2021 Hexical Labs LLC
Privacy Policy  |  Terms of Service
Add Comment