News for hackers. Stuff that matters.

A comment on You've Been Framed. A survey of iframes and the sandbox attribute. Parent comment

Re:You've Been Framed. A survey of iframes and the sandbox a... by TheLoneWolfling on Thursday May 07, 2015 @01:24PM (#9506717)
I'd be wary about that.

If nothing else, what happens if someone visits the site without support for `sandbox`? You best option (not displaying it if the browser doesn't support it) breaks the site for users without JS, or that don't have support `sandbox`.

[ Parent | on HN ]
Re:You've Been Framed. A survey of iframes and the sandbox a... by stefanorri on Thursday May 07, 2015 @03:02PM (#9507452)
Good point. But the sandbox attribute is around 90% [1] of browsers. The number of browsers which don't support it and don't run javascript may be too low to make supporting them practical, but YMMV.

[1] http://caniuse.com/#feat=iframe-sandbox

[ Parent | on HN ]
Re:You've Been Framed. A survey of iframes and the sandbox a... by TheLoneWolfling on Thursday May 07, 2015 @03:12PM (#9507512)
It's IE 8 and 9 that I'd be most worried about in terms of malice.

And I'd be one of those users who would be cut out by JS requirements. Just so you know, that number is not zero.

[ Parent | on HN ]