Protocol on wrapping youtube api in an iframe sandbox to solve security concern
up vote
0
down vote
favorite
My website has a youtube player which uses the Youtube API to create an iframe and swap out the empty div with the iframe. This has been identified as a security risk because the youtube API has externally hosted code and also has access to possible personal information on my website.
The proposed solution would be to wrap an iframe sandbox around the youtube player iframe (iframe within an iframe sandbox). This has been a really difficult topic to research because youtube already uses an iframe, so the search results are diluted. I haven't found any instance of people actually doing this, but it seems like a viable solution.
I'm thinking the best way forward would be to create the iframe sandbox, then use javascript injection to inject the youtube api iframe into the iframe sandbox. Are people doing this at all?
Another possible solution would be to download the youtube player api code locally so it can be controlled by my company. But the issues there are that youtube could update their api and I wouldn't have the updated code, therefore breaking my site.
javascript html iframe youtube sandbox
asked Nov 9 at 23:45
Grant Evans
62
add a comment |
up vote
0
down vote
favorite
My website has a youtube player which uses the Youtube API to create an iframe and swap out the empty div with the iframe. This has been identified as a security risk because the youtube API has externally hosted code and also has access to possible personal information on my website.
The proposed solution would be to wrap an iframe sandbox around the youtube player iframe (iframe within an iframe sandbox). This has been a really difficult topic to research because youtube already uses an iframe, so the search results are diluted. I haven't found any instance of people actually doing this, but it seems like a viable solution.
I'm thinking the best way forward would be to create the iframe sandbox, then use javascript injection to inject the youtube api iframe into the iframe sandbox. Are people doing this at all?
Another possible solution would be to download the youtube player api code locally so it can be controlled by my company. But the issues there are that youtube could update their api and I wouldn't have the updated code, therefore breaking my site.
javascript html iframe youtube sandbox
asked Nov 9 at 23:45
Grant Evans
62
add a comment |
up vote
0
down vote
favorite
up vote
0
down vote
favorite
My website has a youtube player which uses the Youtube API to create an iframe and swap out the empty div with the iframe. This has been identified as a security risk because the youtube API has externally hosted code and also has access to possible personal information on my website.
The proposed solution would be to wrap an iframe sandbox around the youtube player iframe (iframe within an iframe sandbox). This has been a really difficult topic to research because youtube already uses an iframe, so the search results are diluted. I haven't found any instance of people actually doing this, but it seems like a viable solution.
I'm thinking the best way forward would be to create the iframe sandbox, then use javascript injection to inject the youtube api iframe into the iframe sandbox. Are people doing this at all?
Another possible solution would be to download the youtube player api code locally so it can be controlled by my company. But the issues there are that youtube could update their api and I wouldn't have the updated code, therefore breaking my site.
javascript html iframe youtube sandbox
asked Nov 9 at 23:45
Grant Evans
62
My website has a youtube player which uses the Youtube API to create an iframe and swap out the empty div with the iframe. This has been identified as a security risk because the youtube API has externally hosted code and also has access to possible personal information on my website.
The proposed solution would be to wrap an iframe sandbox around the youtube player iframe (iframe within an iframe sandbox). This has been a really difficult topic to research because youtube already uses an iframe, so the search results are diluted. I haven't found any instance of people actually doing this, but it seems like a viable solution.
I'm thinking the best way forward would be to create the iframe sandbox, then use javascript injection to inject the youtube api iframe into the iframe sandbox. Are people doing this at all?
Another possible solution would be to download the youtube player api code locally so it can be controlled by my company. But the issues there are that youtube could update their api and I wouldn't have the updated code, therefore breaking my site.
javascript html iframe youtube sandbox
javascript html iframe youtube sandbox
asked Nov 9 at 23:45
Grant Evans
62
asked Nov 9 at 23:45
Grant Evans
62
asked Nov 9 at 23:45
Grant Evans
62
asked Nov 9 at 23:45
Grant Evans
62
asked Nov 9 at 23:45
Grant Evans
62
62
add a comment |
add a comment |
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53234683%2fprotocol-on-wrapping-youtube-api-in-an-iframe-sandbox-to-solve-security-concern%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
