Am 06.07.2010 12:31 schrieb Aryeh Gregor:
On Tue, Jul 6, 2010 at 4:40 AM, Markus Ernst <[email protected]> wrote:
Thank you and Boris for your examples. I see the security issues. Anyway It
would be very helpful in cases like mine, where security and privacy are not
affected, to get an easy way to do this opt-in without the need of complex
scripting, and independent from @seamless. Embedding content from external
providers looks like a quite common case to me, and an easy opt-in mechanism
would help both the customers and the providers of embedded content.
So what you're saying is that you really do just want seamless="" with
easy cross-origin opt-in, right? That sounds entirely logical, and
I'm not sure why it's not specced already (or at least I don't see
it). Could this be easily added to CORS? CORS isn't so easy to set
up, of course, but I'm not sure it's practical to do better. An HTML
tag would work, for HTML pages (the common case for iframes), but then
the UA wouldn't know whether it's allowed to be seamless until it
started parsing the response, which might have complications.
You are right, the iframe source could be an image, text, or pdf file or
whatever, without meta or script elements. But an in-page HTML solution
would of course make opting-in very easy for authors.
I tried to read about CORS, but did not understand the whole of it. Can
CORS be set up via server-side scripting, with PHP or whatever? Then it
will be an acceptable solution, and sooner or later libraries will be
available for both the server and the client side.
If CORS must be set up by the server administrator, it will be a problem
in shared hosting environments.
Anyway, for something that looks as easy as allowing an iframe to
seamlessly integrate a document, the overhead of server-side setup and
client-side scripting looks huge to me, and it also has the downside of
being dependent on Javascript.
