0

I load an iframe with src = "" on user's site to extract native constants such as Objects, Array etc. But I don't want anyone(specifically the user on whose website i am loading the iframe) to modify my src to prevent cross-site errors. I did some research and I was able to prevent src from being modified by - 

Object.defineProperty(iframeElement,'src', {
    writable: false
});

But the problem is user can still modify using . 

iframeElement.setAttribute('src', value)

How to prevent someone from modifying through calling methods?

megha
  • 41
  • 1
  • 7
  • 1
    You might be fighting a battle you can't win here. You don't own the browser. – tadman May 05 '18 at 18:04
  • Try the [`sandbox` attribute](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox). – Ivar May 05 '18 at 18:04

0 Answers0