Are there any security concerns I should be aware of, if I want to give users the ability to embed iframes(for things like Youtube videos) in their generated content on my site. The user generated content is editable by them, so I can't control iframe options like sandbox(though I might be able to do a check on the content when it comes to the server and insert appropriate options there).
If there are risks, I am thinking of either
- checking the domain of the iframe being inserted and only allowing select domains like Youtube.
- only allowing a select group of trusted users to add iframes in their content.