Suppose www.youtube.com have no X-Frame-Options set.

Imagine I'm already logged in to YouTube. Now from another web page in the same browser I'm loading YouTube in an iframe, will the browser send all the auth-cookies to the YouTube loaded in the iframe so that it will be loaded as logged in?

  • How about making a simple webpage with YouTube in an iframe and see what happens? – multithr3at3d Mar 28 '18 at 19:12

By default, yes, though the sandbox parameter in the iframe tag can change this behavior.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.