Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why not to use iframes for embedded dashboards

embeddable.com

Post reply on HN
Print view View original

11–20 of 22 posts

Re: Why not to use iframes for embedded dashboards

#11

Post by NoahZuniga »

bawolff wrote: post #2

> Security teams have raised red flags about iframes for years. Cross-frame scripting, clickjacking, and credential phishing are common exploits, since the frame executes third-party code inside your trusted domain I would disagree. Yes iframes have security risks, but they generally pale in comparison to giving some other random site full control of your page, which is the alternative.

Also clickjacking isn't a security risk for the page embedding the iframe. This shows fundemental misunderstanding.

Re: Why not to use iframes for embedded dashboards

#13

Post by sollewitt »

btbuildem wrote: post #9

I keep revisiting this approach over and over again - I don't know, maybe I never learn. I'm not interested in analytics dashboards, my context is more around stringing together prototype/poc services into workflow pipelines. The idea usually is along the lines of "have an orchestrator service that knows what the user is trying to do, and serves a sequence of specific, embedded micro-UIs backed by services that imple…

I worked on a project exploring this idea and an issue is that while each step in a user journey (get restaurants near me, show me menus, make an order, show me on a map) could invoke a distinct service, provided by different providers that just do that thing well, they all want ownership of the experience and the precious user data and prefer to consume input and render output rather provide output data for others to use - there’s no stdout to pipe. The upshot is apps do everything, which is the opposite of the Unix philosophy.

Re: Why not to use iframes for embedded dashboards

#14

Post by johnisgood »

bawolff wrote: post #2

> Security teams have raised red flags about iframes for years. Cross-frame scripting, clickjacking, and credential phishing are common exploits, since the frame executes third-party code inside your trusted domain I would disagree. Yes iframes have security risks, but they generally pale in comparison to giving some other random site full control of your page, which is the alternative.

I have never understood the argument against iframes involving security.

Re: Why not to use iframes for embedded dashboards

#17

Post by ewf »

It was a hard requirement for us to make our dev tool 100% embeddable without iframes. From the vendor's perspective, it's an opportunity to differentiate from competitors and avoid potential future iframe limitations that others have mentioned.

This was my instinct when we first started, and years later, on 50% of sales calls someone asks if we use iframes (as a concern). Our enterprise clients don't want to highlight a third-party solution, and iframes scream "not native" to their users.

The technical challenges of avoiding iframes are real, but the business case for solving them has been clear for us.

Re: Why not to use iframes for embedded dashboards

#18

Post by haburka »

My experience reading this article was being confused about why someone is listing all the drawbacks with i-frames - even obscure drawbacks that most people would not ever encounter. Then I noticed it’s just an Ad for their product.

I think this kind of blog post should be illegal - there needs to be a disclosure at the beginning, ie, this is informative but it’s also an advertisement. Then I would know to not read any further.

I-frames are actually pretty useful tools. They’re the only way to allow HTML content from another site to exist on your site without trusting or sanitizing it. They actually work pretty well for dashboards.

They come with some serious drawbacks, most notably, not being able to edit the content of the iframe.

I generally prefer using an API or a npm module so I can customize the content of the iframe.

Re: Why not to use iframes for embedded dashboards

#19

Post by icedchai »

johnisgood wrote: post #14
bawolff wrote: post #2

> Security teams have raised red flags about iframes for years. Cross-frame scripting, clickjacking, and credential phishing are common exploits, since the frame executes third-party code inside your trusted domain I would disagree. Yes iframes have security risks, but they generally pale in comparison to giving some other random site full control of your page, which is the alternative.

I have never understood the argument against iframes involving security.

Many of these arguments are context dependent. If I embed an iframe, then ask a user to log in / provide credentials to whatever is loaded into that iframe, I can see the argument since it is difficult to for the user to verify the origin. However, for something "read only" like a dashboard, I really don't see the argument.

Re: Why not to use iframes for embedded dashboards

#20

Post by ewf »

haburka wrote: post #18

My experience reading this article was being confused about why someone is listing all the drawbacks with i-frames - even obscure drawbacks that most people would not ever encounter. Then I noticed it’s just an Ad for their product. I think this kind of blog post should be illegal - there needs to be a disclosure at the beginning, ie, this is informative but it’s also an advertisement. Then I would know to not read a…

it's for seo. they could have framed it better
Post reply on HN