You probably don't need iframes for external content

http://leo.github.io/blog/giving-iframes-the-brush-off/

by mindrun • 11 years ago

3 5 11 years ago

leo.github.io

benologist• 11 years ago

That's an interesting discovery but iframes are also an important security sandbox and even more so in HTML5.

mindrun2• 11 years ago

Hehe, that's a another good point! Didn't think of the "sandbox" attribute before, will do so next time I write about iframes. Thanks for the info!

oliwarner2• 11 years ago

This is a poorly thought out argument. I iframes allow content and scripts from another domain context to be safely embedded within the parent scope.

Styling barely registers as a problem at all; we could always use inline or JS-DOM-set styles to override parent stylesheets.

That's not to say there isn't value in unset. There is, just not here.

mindrun2• 11 years ago

I think that's exactly the problem I was trying to pass: I don't want to use JS to modify the content of an iframe that's embedded in my site. Why? Because it's dirty.

The advantage of using the 'all' property is that big companies like Twitter or Google could simply provide us with a CSS stylesheet that formats a specific HTML to look like a tweet. Then we (as developers) would be able to manage the download of the tweet server-side. This will lead to the fact that the client has to make much less requests to third-party servers -> faster site.

I may have struggled a bit with formulating my idea behind this whole scenario. I will try to do that better in the future... :)

oliwarner2• 11 years ago

What is stopping you from fetching the tweet server-side right now? There are a hundred APIs around for doing just that, in whatever language and protocol you want.

Fetch it, copy the embedded images to your servers and present it based on your stylesheet. Recreating how a tweet looks is very simple stuff.

Now you have something that won't break if Twitter dies or the user deletes their post. It won't break if your user's DNS is intermittent. It won't force your users' clients to do umpteen separate requests. And you can host it through SPDY and HTTP/2 because it's all coming from you.

"Embedding" tweets is a horrible, lazy idea from people who want to control and log who views "their" content wherever it's being used. The last thing I want is them dumping even more crap directly on my domain.

---

I'm not saying unset doesn't have a place. It might even have a place here, but highlighting a misuse of iframes as a reason why it's going to be good, isn't a good start.

I hope I've explained why it's already not the best idea above.

You probably don't need iframes for external content

Related Stories