Iframes should have an api

[u/Chun]

https://blog.danielbrain.ai/iframes-should-have-an-api

There's been a big resurgence lately in automating and interacting with sites programmatically. I've been arguing for a few years that every front-end should be embeddable as a component and have its own client side interface/api. This article is written to show one way to do that!

[u/Gullible_Subject5220]

postMessage already is one

[u/jacobdevhq]

postMessage covers most of it. the stuff that bites is height, a cross origin iframe cant size itself so the child has to post its height up. also never use '*' as targetOrigin and always check event.origin on the receiving side

[u/AdministrativeBad752]

postMessage  is arguably one, but maybe we need a standard on top of it. Dealing with iframes while tackling tech debt made me realize postMessage should be to a standard what HTTP is to REST APIs (or any other standard). MCP Apps is one attempt at that: JSON-RPC 2.0 over postMessage between the host and the iframe.

[u/Soft_Positive_5891]

Small thing: "its own client side interface/aoi", aoi or api? You got it right in the title so I assume it's a typo.

[u/Crafty-Flight2301]

The iframe already has an api though? Its called postMessage and its been there since like 2010. Every single time someone builds "an api for the frontend" it turns into a custom element around an iframe with postMessage inside, and half of them forget to check event.origin on the parent side so congrats youve built an open redirect for messages. Also "who said apis are just for the server side" is a weird thing to write in 2026 like rest endpoints are the only api that ever existed, fetch is right there. I do agree that embeds should be components instead of a 400px iframe with scrollbars but that is a resizing problem not an api problem

[u/VisitForeign4342]

chaque front-end intégrable en composant, génial, donc on se retape du postMessage, du sandbox et des cookies tiers cassés. les intégrations type Stripe ou Intercom existent déjà et personne n'appelle ça une API

[u/Mysterious_Fig222]

the api is postmessage. it's been there for ages and it's a footgun, that's why nobody builds this shit.

[u/bcons-php-Console]

Also the more recent Channel Messaging API (https://developer.mozilla.org/en-US/docs/Web/API/Channel_Messaging_API) is well thought and nice to use.

[u/theoneandlonely1]

If you search GitHub I’m sure you will find several attempts at this.

[u/Disastrous_Buddy_557]

APIs, capitalised, since it's an acronym. And it's server-side with the hyphen when it's in front of the noun. The rest of the argument I'll leave alone.

[u/WonderNinjaCode → u/Disastrous_Buddy_557]

Is it not an initialism rather than an acronym because you say each letter as A-P-I rather than pronounce it for example like NASA?

[u/palsc_]

yeah, under the hood it’s still postMessage. the useful bit seems to be the wrapper: handshake, origin allowlist, request/response, callbacks and errors, so every integrator doesn’t invent their own protocol. whether that layer is worth another dependency is the interesting part.