Currently, we have a small personal project which is meant to allow people to create 'profiles' in HTML/CSS. We aim to put all this generated content within a sandboxed iframe. The next point in discussion comes from allowing scripts in these iframes since users will be able to enter whatever content they want.

Couple things to note:

  • The site has a cross-origin policy of: allow-all
  • Authorization is handled through tokens stored within a React app. Not cookies.

I am mostly curious on the security risks of such a design and I have not found a clear concise answer. Should allow scripts within these iframes? or does this pose too much of a risk? What type of attacks are we looking at through an iframe? I am concerned mostly with XSS-type attacks. What about browser vulnerabilities with iframes?

  • So to be clear, the profiles will be published by the people in question and hosted on their own sites, and then you are going to include those sites in yours via iframes? – Conor Mancone Sep 11 '19 at 17:47
  • To clarify, and I apologize. I never saw the response. Users load their HTML code which is then injected into a sandboxed Iframe. – Lpuche Feb 11 at 22:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.