Iframe and web security glossary
Short, plain definitions of 24 terms you meet when you embed a page: headers, cookies, origins, and iframe attributes.
Updated
/
A
1 term
C
7 terms
- ClickjackingAn attack that hides a page in a transparent frame to trick people into clicks.
- Content-Security-PolicyHeader that tells the browser what a page may load and who may frame it.
- CORSRules that let a server allow scripts on other origins to read its responses.
- Cross-origin isolationA page state, set by COOP and COEP headers, that unlocks SharedArrayBuffer and precise timers.
- Cross-Origin-Embedder-PolicyCOEP. Header that blocks cross-origin resources that do not opt in to be embedded.
- Cross-Origin-Opener-PolicyCOOP. Header that separates your window from pop-ups and openers on other origins.
- Cross-Origin-Resource-PolicyCORP. Header that says which origins may load a resource.
F
2 terms
I
1 term
L
1 term
O
1 term
P
2 terms
R
1 term
S
6 terms
- Same-origin policyBrowser rule that stops a page from reading the data of another origin.
- SameSiteCookie attribute that controls if the browser sends a cookie on cross-site requests.
- sandboxIframe attribute that removes powers from the frame, such as scripts or forms.
- Site (same-site)The scheme and registrable domain of a URL. www.example.com and app.example.com are one site.
- srcdocIframe attribute that holds the HTML of the frame inline, with no URL.
- Storage Access APILets a frame ask for access to its own cookies when it is third-party.
T
1 term
X
1 term