In my web app I'm using a good sanitizer which let's me to whitelist some specific html tags. I'd like to allow <iframe> so that users can insert youtube videos and so on. However I'm worried about vulnerabilities that this approach would introduce. So not sure this is a safe idea. Appreciate your hints about this.


1 Answer 1


"As soon as you're displaying content from another domain, you're basically trusting that domain not to serve-up malware. There's nothing wrong with iframes per se. If you control the content of the iframe, they're perfectly safe." - Shamelessly stolen from this thread.

However your web app could be vulnerable if there is XSS vulnerability inside the iframe content. You can mitigating this by setting the sandbox attribute.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.