Why not to use iframes for embedded dashboards(embeddable.com) |
Why not to use iframes for embedded dashboards(embeddable.com) |
I would disagree.
Yes iframes have security risks, but they generally pale in comparison to giving some other random site full control of your page, which is the alternative.
You're still giving a 3rd party full access to your website, but at least it's more auditable and safe.
Fwiw, I think iframes are great!
Do people really audit such code? I doubt it. Does the code really not insert any additional code that allows bypassing the whole scheme (esp. If the point is to dynamically insert content).
I also think most of the time, the biggest threat is not the vendor being intentionally evil but the vendor making a mistake that leads to XSS which someone else exploits. After all, if the vendor is intentionally being malicious they can probably sneakily bypass this sort of thing.
Is that really true? Aren't most end users now used to, e.g., YouTube and Twitter iframes looking exactly the same everywhere, no matter what the surrounding site looks like?
This was my instinct when we first started, and years later, on 50% of sales calls someone asks if we use iframes (as a concern). Our enterprise clients don't want to highlight a third-party solution, and iframes scream "not native" to their users.
The technical challenges of avoiding iframes are real, but the business case for solving them has been clear for us.
I think this kind of blog post should be illegal - there needs to be a disclosure at the beginning, ie, this is informative but it’s also an advertisement. Then I would know to not read any further.
I-frames are actually pretty useful tools. They’re the only way to allow HTML content from another site to exist on your site without trusting or sanitizing it. They actually work pretty well for dashboards.
They come with some serious drawbacks, most notably, not being able to edit the content of the iframe.
I generally prefer using an API or a npm module so I can customize the content of the iframe.
That said, things like SRI don't really fully fix the supply chain issue. Supply chain issues usually mean the developer intentionally upgrades to a new version, that unbeknownst to them is malicious. It is usually not about a resource getting replaced with nobody realizing it, everyone realizes the upgrade is happening. In such a situation it is likely SRI hashes would get upgraded too.
Solutions like hashes or digital signatures are useless if the person being tricked is the one responsible for signing things.