Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

What is the difference between srcdoc="..." and src="data:text/html,..." in an <iframe>?

Tags:

html

iframe

For example, which is the difference between these:

<iframe srcdoc="<p>Some HTML</p>"></iframe> <iframe src="data:text/html,<p>Some HTML</p>"></iframe> 

Demo

And, in case they are exactly the same, why did HTML5 add srcdoc attribute?

Edit

Maybe I wasn't clear enough. I am not comparing src with srcdoc, but src using text/html data URI with srcdoc.

Then, if the functionality chart is like this

                    |  src attribute       |  srcdoc attribute  --------------------------------------------------------------------   URL              |  Yes                 |  No without using src (*)   HTML content     |  Yes, using data URI |  Yes 

why is srcdoc needed?


(*) Note:

It seems srcdoc can be used to load a page by URL (Demo), using a subiframe with srcattribute:

<iframe srcdoc="<iframe src='http://microsoft.com'></iframe>"></iframe> 
like image 933
Oriol Avatar asked Nov 02 '13 04:11

Oriol


People also ask

What is Srcdoc iframe?

The srcdoc attribute specifies the HTML content of the page to show in the inline frame. Tip: This attribute is expected to be used together with the sandbox and seamless attributes. If a browser supports the srcdoc attribute, it will override the content specified in the src attribute (if present).

What is src in iframe tag?

The src attribute specifies the address of the document to embed in an iframe.

Can I use iframe Srcdoc?

HTML | <iframe> srcdoc Attribute The HTML <iframe> srcdoc Attribute is used to specify the HTML content of the document in the element. It can be used together with the sandbox and seamless attributes. HTML_code: It is used to specify the HTML content of the page which will display in an Iframe element.

What does the src attribute of iframe tag specifies?

The HTML <iframe> src attribute is used to specify the URL of the document that are embedded to the <iframe> element. Attribute Values: It contains single value URL which specifies the URL of the document that is embedded to the iframe.


2 Answers

The other answers list some superficial differences, but really miss the mark of the key difference that explains why browsers/spec writers would essentially duplicate something that already exists:

<iframe src="data:...untrusted content" sandbox /> <- Secure in modern browsers, insecure in legacy browsers with no sandbox support

<iframe srcdoc="...untrusted content" sandbox /> <- Secure in modern browsers, secure (though non-functional) in legacy browsers

This new syntax provides content authors a way to protect their users, even when they may be using legacy browsers. Without it, content authors would be reluctant to use the sandbox feature at all, and it would not see use.

like image 169
Fabio Beltramini Avatar answered Nov 07 '22 09:11

Fabio Beltramini


From MDN :

1. The content of the page that the embedded context is to contain. This attribute is expected to be used together with the sandbox and seamless attributes. If a browser supports the srcdoc attribute, it will override the content specified in the src attribute (if present). If a browser does NOT support the srcdoc attribute, it will show the file specified in the src attribute instead (if present).

So, the srcdoc attribute overrides the content embedded using src attribute.

Demo


Also, what you are saying about the following snippet data:text/html is called Data URI and it has limitations..

2. Data URIs cannot be larger than 32,768 characters.

1. MDN, 2. MSDN

like image 23
Mr. Alien Avatar answered Nov 07 '22 10:11

Mr. Alien