On Sun, May 27, 2012 at 3:00 AM, Markus Ernst <[email protected]> wrote: > Am 27.05.2012 02:16 schrieb Adam Barth: >> I've added a proposal to the wiki >> <http://wiki.whatwg.org/wiki/AllowSeamless> about letting a document >> indicate that it is willing to be displayed seamlessly with a >> cross-origin parent. This proposal is a refinement of the approach >> previously discussed in this thread: >> <http://old.nabble.com/crossorigin-property-on-iframe-td33677754.html>. >> >> Let me know if you have any feedback. > > I have a strong feeling that per-origin control should be made easy for > authors. I must admit that I am not familiar with the mechanisms you name, > Frame-Options and ancestor-origins - and both are quite hard to google for. > From what I found I assume both are about HTTP headers. > > If they are solutions that can be used easily with server-side languages > such as PHP, I think we can live with it. But anyway it is a complication; > I'd personnally prefer something like > allowseemles="example.org, *.example.org, shop.otherdomain.com" > > Or maybe space separated, and separate inherit-style with comma: > allowseemles="example.org *.example.org shop.otherdomain.com, inherit-style" > > (Regardless of whether it is in the HTML element or in a META element.)
I had difficulty coming up with use cases that weren't better served with frame-ancestors and/or Frame-Options. Do you have a specific use case in mind to explain your feelings? Adam
