0

Is there any way to only allow parent to control iframe, but no iframe to control parent in html/javascript?

I am making a sandbox mode for my website, and I want people to be able to make their own javascript, but I don't want to allow them to change my site. On the other hand, I might want to add scripts that change things in the iframe.

I see that in newer browsers there is a way to sandbox the iframe - sandbox.

My question is, has anyone come up with a way to make it work unilaterally?

Nur Bar
  • 731
  • 2
  • 8
  • 16
  • Possible duplicate of [iFrame isolation](http://stackoverflow.com/questions/2672484/iframe-isolation) – nardnob Nov 19 '15 at 03:47

1 Answers1

1

This was already answered there :

iFrame isolation

The answer is apparently no, there is no way to do that...

In the comment, somebody says something about security and having your IFrame in a different domain than the parent. Maybe you can try if your browser support this feature.

Community
  • 1
  • 1
Guillaume F.
  • 5,905
  • 2
  • 31
  • 59
  • I don't think this is completely correct - using http://www.w3schools.com/tags/att_iframe_sandbox.asp - you can block both sides - so I was wondering if I can do it unilaterally - anyway, so this answer is outdated it seems to me? – Nur Bar Nov 19 '15 at 04:42
  • Yes sandbox is new to HTML5. Sadly this is not what you are looking for. The only solution I see would be to write a plugin to manage the isolation yourself. – Guillaume F. Nov 19 '15 at 04:48