Disable changing URL from IFRAME

Question

I have my HTML5 games site FunInBrowser.com . I have a list of third party URLs, which should contain HTML5 games. I display those games inside a small IFRAME and put title, description, rating around it. The game may look like this: Connection .

Some guy uploaded his URL, which looks OK, but it changes the top URL from IFRAME . Here it is: Draughts . I didn't even know, that you can have this level of control from IFRAME.

Is there any way to forbid this behavior of IFRAME? I want to keep games in small frame and stay at the same URL.

Answer 1

In html5 you can use sandbox attribute. But not all browsers suppor it. There is a good article about it http://www.html5rocks.com/en/tutorials/security/sandboxed-iframes/ Browser support table is here http://caniuse.com/iframe-sandbox

Answer 2

You should be able to add an event listener for onbeforeunload to the iframe, which checks the new URL against a list of valid URLs. In the event handler, be sure not to return a string, unless you want the "Are you sure you want to exist this page?" dialog to appear.

I should add, though, that this doesn't prevent his page from overriding the event handler you set up. It should work for your current scenario, but would be pretty trivial for him to work around.