When I first start working with iframes that belongs to a third part application, it comes to my mind the possibility to manipulate them. My first stone in the road Same-origin-policy. If the iframe comes from a different domain, a browser's cross-domain policy would kick in, preventing the iframe from accessing cookies, local storage, or the DOM from its embedding document.
After getting deep into Same origin policy I found that this is not just an specific issue with iframes. The problem comes when you try to change the URL to point to a different domain such as http://domain.com/users/guille. The reason this fails is because there are security implications that come with making requests to different origins. I won’t bore you with specifics, but you can read more here.
The one item that bypasses this limitation is `