[whatwg] Iframe dimensions

[Aryeh Gregor]

On Tue, Jul 6, 2010 at 4:40 AM, Markus Ernst <derernst at gmx.ch> wrote:
> Thank you and Boris for your examples. I see the security issues. Anyway It
> would be very helpful in cases like mine, where security and privacy are not
> affected, to get an easy way to do this opt-in without the need of complex
> scripting, and independent from @seamless. Embedding content from external
> providers looks like a quite common case to me, and an easy opt-in mechanism
> would help both the customers and the providers of embedded content.

So what you're saying is that you really do just want seamless="" with
easy cross-origin opt-in, right?  That sounds entirely logical, and
I'm not sure why it's not specced already (or at least I don't see
it).  Could this be easily added to CORS?  CORS isn't so easy to set
up, of course, but I'm not sure it's practical to do better.  An HTML
tag would work, for HTML pages (the common case for iframes), but then
the UA wouldn't know whether it's allowed to be seamless until it
started parsing the response, which might have complications.

I don't know why you keep saying "independent from @seamless" without
giving any reason for it.  Seamless seems like exactly what you want.