There was a day not way back the place a Google Chrome browser replace left any web page with a CodePen Embed on it throwing an entire huge pile of purple JavaScript errors within the console. Not perfect, clearly.
The change was associated to how the browser handles permit attributes on iframes (i.e. <iframe permit="...">). CodePen was calculating the suitable values inside an iframe for a nested iframe. That will need to have been a safety situation of types, as now these values must be current on the exterior iframe as nicely.
We documented all this in a weblog publish so hopefully we may get some consideration from Chrome on this, and for different browser makers as nicely because it impacts all of us.
And I posted it on the ol’ social media:
https://bsky.app/profile/chriscoyier.internet/publish/3m3nnlnsyks2b
Enormous because of Bramus Van Damme who noticed this, triaged it at Chrome, and had a decision inside a day:
I believe the patch is a superb change so hats off to everybody concerned for getting it executed so rapidly. It’s already in Canary and don’t actually know when it’ll get the steady however that positive can be good. It follows how Safari is doing issues the place values that aren’t understood are simply ignored (which we expect is okay and inline with how HTML usually works).
Fortuitously we have been in a position to mitigate the issue a bit of till then. For most Embedded Pens, a <script> is loaded on the web page embedding it, and we dynamically create the <iframe> for you. That is simply good because it makes making an accessible fallback simpler and offers you entry to API-ish options for the embeds. We have been in a position to increase that script to perform a little browser user-agent sniffing and apply the right set of permit attributes on the iframe, as to keep away from these JavaScript errors we have been seeing.
However there’s the rub: we’d quite not do any user-agent sniffing in any respect.
If we may simply put all the potential permit attributes we wish on there, and never be terribly involved if any specific browser didn’t assist any specific worth, that will be perfect. We simply can’t have the scary console errors, out of concern for our customers who could not perceive them.
The place we’re at within the saga now’s that:
- We’re ready for the change to Chrome to get to steady.
- We’re hoping Safari stays the way in which it’s.
- OH HI FIREFOX.
On that final level, if we put all of the permit attributes we’d need to on an <iframe> in Firefox, we additionally get console-bombed. This time not with red-errors however with yellow-warnings.
So sure, hello Firefox, if you happen to may additionally not show these warnings (except a reporting URL is ready up) that will be nice. We’d be one much less web site on the market counting on user-agent sniffing.
