Restrict Access to a JavaScript Application Embedded via an iframe
One common way to embed a JavaScript application in a web page is using iframe. Assuming the application is accessible from https://example.com/my-app and the embedding page is https://example.com/content, the embedding code in the embedding page would look like this: <body> <!-- Other content... --> <iframe src="https://example.com/my-app"><iframe> <!-- Other content... --> </body> This approach works for an application written in either vanilla JavaScript or any frameworks, like React or Vue. However, this risks two potentially undesired effects: Other websites may embed this application with iframe without permission. The visitor may visit the embedded iframe directly and thus have skipped the content of the parent page. This post discusses solutions that address these two problems. ...