#iframes

Cybersecurity firm Imperva found a vulnerability that could be used to leak user information such as email addresses and phone numbers, which has now been patched.

In Webdriver, you should use driver.switchTo().defaultContent(); to get out of a frame.

You need to get out of all the frames first, then switch into the desired frame.

driver.switchTo().defaultContent(); // you are now out of the frames

Browsers have a same-origin policy to prevent different domains from interacting with each others’ DOMs. 

This is why Stripe is safe to use. Because Stripe’s credit card input field is inside Stripe’s iframe, even if the iframe is on a site called scamwebsite.com, there is no way for scamwebsite.com to actually query the DOM to see what your credit card info is.

However, browser vendors realize that there are situations where you want to be able to communicate with an iframe, like maybe you want to listen for when Stripe Checkout is done so you can proceed to the next page. This is where postMessage comes in. 

https://developer.mozilla.org/en-US/docs/Web/API/Window/postMessage

postMessage offers a messaging API so that you can communicate with the iframe, as long as you and your iframe both explicitly expect this communication.

And the way you would use it would just be like this:

iframeWindow.postMessage(’saying hi to my iframe’, ‘https://stripe.com’)

Now, the documentation says that the 2nd argument, targetOrigin, can actually be a wildcard. That makes things easy. 

iframeWindow.postMessage(’saying hi to my iframe’, ‘*’)

Why wouldn’t I just always use that?

In episode 276 of the weekly Hump Day Hangouts by Semantic Mastery ( one viewer asked if iframes count as backlinks.

The exact question was:

Do Iframes count as backlinks? Whats really the advantage in making use of Iframes?

If you’re an agency owner or consultant that wants to get more clients, grow your revenue and scale your team so that they can work less and earn more. If you want to learn…