pub struct Iframe<'life> {Show 29 fields
pub accesskey: Option<&'life str>,
pub allow: Option<&'life str>,
pub allowfullscreen: Option<&'life str>,
pub allowpaymentrequest: Option<&'life str>,
pub autocapitalize: Option<&'life str>,
pub autofocus: Option<bool>,
pub class: Option<&'life str>,
pub contenteditable: Option<&'life str>,
pub contextmenu: Option<&'life str>,
pub credentialless: Option<&'life str>,
pub csp: Option<&'life str>,
pub data: Option<BTreeMap<&'life str, &'life str>>,
pub dir: Option<&'life str>,
pub draggable: Option<&'life str>,
pub enterkeyhint: Option<&'life str>,
pub exportparts: Option<&'life str>,
pub height: Option<&'life str>,
pub hidden: Option<bool>,
pub id: Option<&'life str>,
pub inert: Option<&'life str>,
pub inputmode: Option<&'life str>,
pub is: Option<&'life str>,
pub loading: Option<&'life str>,
pub name: Option<&'life str>,
pub referrerpolicy: Option<&'life str>,
pub sandbox: Option<&'life str>,
pub src: Option<&'life str>,
pub srcdoc: Option<&'life str>,
pub width: Option<&'life str>,
}
Expand description
The <iframe>
HTML element represents a nested browsing context, embedding another HTML page into the current one.
More information: https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe
Fields§
§accesskey: Option<&'life str>
Provides a hint for generating a keyboard shortcut for the current element. This attribute consists of a space-separated list of characters. The browser should use the first one that exists on the computer keyboard layout.
allow: Option<&'life str>
Specifies a Permissions Policy for the <iframe>
. The policy defines what features are available to the <iframe>
(for example, access to the microphone, camera, battery, web-share, etc.) based on the origin of the request.
Note: A Permissions Policy specified by the allow
attribute implements a further restriction on top of the policy specified in the Permissions-Policy
header. It doesn't replace it.
allowfullscreen: Option<&'life str>
Set to true
if the <iframe>
can activate fullscreen mode by calling the requestFullscreen()
method.
Note: This attribute is considered a legacy attribute and redefined as allow="fullscreen"
.
allowpaymentrequest: Option<&'life str>
Set to true
if a cross-origin <iframe>
should be allowed to invoke the Payment Request API.
Note: This attribute is considered a legacy attribute and redefined as allow="payment"
.
autocapitalize: Option<&'life str>
Controls whether and how text input is automatically capitalized as it is entered/edited by the user. It can have the following values:
off
ornone
, no autocapitalization is applied (all letters default to lowercase)on
orsentences
, the first letter of each sentence defaults to a capital letter; all other letters default to lowercasewords
, the first letter of each word defaults to a capital letter; all other letters default to lowercasecharacters
, all letters should default to uppercase
autofocus: Option<bool>
Indicates that an element is to be focused on page load, or as soon as the <dialog>
it is part of is displayed. This attribute is a boolean, initially false.
class: Option<&'life str>
A space-separated list of the classes of the element. Classes allow CSS and JavaScript to select and access specific elements via the class selectors or functions like the method Document.getElementsByClassName()
.
contenteditable: Option<&'life str>
An enumerated attribute indicating if the element should be editable by the user. If so, the browser modifies its widget to allow editing. The attribute must take one of the following values:
true
or the empty string, which indicates that the element must be editable;false
, which indicates that the element must not be editable.
credentialless: Option<&'life str>
Set to true
to make the <iframe>
credentialless, meaning that its content will be loaded in a new, ephemeral context. It doesn't have access to the network, cookies, and storage data associated with its origin. It uses a new context local to the top-level document lifetime. In return, the Cross-Origin-Embedder-Policy
(COEP) embedding rules can be lifted, so documents with COEP set can embed third-party documents that do not. See IFrame credentialless for more details.
csp: Option<&'life str>
A Content Security Policy enforced for the embedded resource. See HTMLIFrameElement.csp
for details.
data: Option<BTreeMap<&'life str, &'life str>>
Forms a class of attributes, called custom data attributes, that allow proprietary information to be exchanged between the HTML and its DOM representation that may be used by scripts. All such custom data are available via the HTMLElement
interface of the element the attribute is set on. The HTMLElement.dataset
property gives access to them.
dir: Option<&'life str>
An enumerated attribute indicating the directionality of the element's text. It can have the following values:
ltr
, which means left to right and is to be used for languages that are written from the left to the right (like English);rtl
, which means right to left and is to be used for languages that are written from the right to the left (like Arabic);auto
, which lets the user agent decide. It uses a basic algorithm as it parses the characters inside the element until it finds a character with a strong directionality, then it applies that directionality to the whole element.
draggable: Option<&'life str>
An enumerated attribute indicating whether the element can be dragged, using the Drag and Drop API. It can have the following values:
true
, which indicates that the element may be draggedfalse
, which indicates that the element may not be dragged.
enterkeyhint: Option<&'life str>
Hints what action label (or icon) to present for the enter key on virtual keyboards.
exportparts: Option<&'life str>
Used to transitively export shadow parts from a nested shadow tree into a containing light tree.
height: Option<&'life str>
The height of the frame in CSS pixels. Default is 150
.
An enumerated attribute indicating that the element is not yet, or is no longer, relevant. For example, it can be used to hide elements of the page that can't be used until the login process has been completed. The browser won't render such elements. This attribute must not be used to hide content that could legitimately be shown.
id: Option<&'life str>
Defines a unique identifier (ID) which must be unique in the whole document. Its purpose is to identify the element when linking (using a fragment identifier), scripting, or styling (with CSS).
inert: Option<&'life str>
A boolean value that makes the browser disregard user input events for the element. Useful when click events are present.
inputmode: Option<&'life str>
Provides a hint to browsers about the type of virtual keyboard configuration to use when editing this element or its contents. Used primarily on <input>
elements, but is usable on any element while in contenteditable
mode.
is: Option<&'life str>
Allows you to specify that a standard HTML element should behave like a registered custom built-in element (see Using custom elements for more details).
loading: Option<&'life str>
Indicates how the browser should load the iframe:
eager
: Load the iframe immediately, regardless if it is outside the visible viewport (this is the default value).lazy
: Defer loading of the iframe until it reaches a calculated distance from the viewport, as defined by the browser.
name: Option<&'life str>
A targetable name for the embedded browsing context. This can be used in the target
attribute of the <a>
, <form>
, or <base>
elements; the formtarget
attribute of the <input>
or <button>
elements; or the windowName
parameter in the window.open()
method.
referrerpolicy: Option<&'life str>
Indicates which referrer to send when fetching the frame's resource:
no-referrer
: TheReferer
header will not be sent.no-referrer-when-downgrade
: TheReferer
header will not be sent to origins without TLS (HTTPS).origin
: The sent referrer will be limited to the origin of the referring page: its scheme, host, and port.origin-when-cross-origin
: The referrer sent to other origins will be limited to the scheme, the host, and the port. Navigations on the same origin will still include the path.same-origin
: A referrer will be sent for same origin, but cross-origin requests will contain no referrer information.strict-origin
: Only send the origin of the document as the referrer when the protocol security level stays the same (HTTPS→HTTPS), but don't send it to a less secure destination (HTTPS→HTTP).strict-origin-when-cross-origin
(default): Send a full URL when performing a same-origin request, only send the origin when the protocol security level stays the same (HTTPS→HTTPS), and send no header to a less secure destination (HTTPS→HTTP).unsafe-url
: The referrer will include the origin and the path (but not the fragment, password, or username). This value is unsafe, because it leaks origins and paths from TLS-protected resources to insecure origins.
sandbox: Option<&'life str>
<p>Applies extra restrictions to the content in the frame. The value of the attribute can either be empty to apply all restrictions, or space-separated tokens to lift particular restrictions:</p>
<ul>
<li><code>allow-downloads</code>: Allows downloading files through an <a href="/en-US/docs/Web/HTML/Element/a"><code><a></code></a> or <a href="/en-US/docs/Web/HTML/Element/area"><code><area></code></a> element with the <a href="/en-US/docs/Web/HTML/Element/a#download">download</a> attribute, as well as through the navigation that leads to a download of a file. This works regardless of whether the user clicked on the link, or JS code initiated it without user interaction.</li>
<li><code>allow-downloads-without-user-activation</code> <abbr class="icon icon-experimental" title="Experimental. Expect behavior to change in the future.">
<span class="visually-hidden">Experimental</span>
: Allows for downloads to occur without a gesture from the user.
allow-forms
: Allows the page to submit forms. If this keyword is not used, form will be displayed as normal, but submitting it will not trigger input validation, sending data to a web server or closing a dialog.allow-modals
: Allows the page to open modal windows by Window.alert()
, Window.confirm()
, Window.print()
and Window.prompt()
, while opening a <dialog>
is allowed regardless of this keyword. It also allows the page to receive BeforeUnloadEvent
event.allow-orientation-lock
: Lets the resource lock the screen orientation.allow-pointer-lock
: Allows the page to use the Pointer Lock API.allow-popups
: Allows popups (like from Window.open()
, target=“_blank”
, Window.showModalDialog()
). If this keyword is not used, that functionality will silently fail.allow-popups-to-escape-sandbox
: Allows a sandboxed document to open new windows without forcing the sandboxing flags upon them. This will allow, for example, a third-party advertisement to be safely sandboxed without forcing the same restrictions upon the page the ad links to.allow-presentation
: Allows embedders to have control over whether an iframe can start a presentation session.allow-same-origin
: If this token is not used, the resource is treated as being from a special origin that always fails the same-origin policy (potentially preventing access to data storage/cookies and some JavaScript APIs).allow-scripts
: Allows the page to run scripts (but not create pop-up windows). If this keyword is not used, this operation is not allowed.allow-storage-access-by-user-activation
Experimental
: Lets the resource request access to the parent’s storage capabilities with the Storage Access API.allow-top-navigation
: Lets the resource navigate the top-level browsing context (the one named _top
).allow-top-navigation-by-user-activation
: Lets the resource navigate the top-level browsing context, but only if initiated by a user gesture.allow-top-navigation-to-custom-protocols
: Allows navigations to non-http
protocols built into browser or registered by a website. This feature is also activated by allow-popups
or allow-top-navigation
keyword.Note:
- When the embedded document has the same origin as the embedding page, it is strongly discouraged to use both
allow-scripts
andallow-same-origin
, as that lets the embedded document remove thesandbox
attribute — making it no more secure than not using thesandbox
attribute at all. - Sandboxing is useless if the attacker can display content outside a sandboxed
iframe
— such as if the viewer opens the frame in a new tab. Such content should be also served from a separate origin to limit potential damage.
src: Option<&'life str>
The URL of the page to embed. Use a value of about:blank
to embed an empty page that conforms to the same-origin policy. Also note that programmatically removing an <iframe>
's src attribute (e.g. via Element.removeAttribute()
) causes about:blank
to be loaded in the frame in Firefox (from version 65), Chromium-based browsers, and Safari/iOS.
srcdoc: Option<&'life str>
Inline HTML to embed, overriding the src
attribute. If a browser does not support the srcdoc
attribute, it will fall back to the URL in the src
attribute.
width: Option<&'life str>
The width of the frame in CSS pixels. Default is 300
.
Trait Implementations§
source§impl<'life> Ord for Iframe<'life>
impl<'life> Ord for Iframe<'life>
1.21.0 · source§fn max(self, other: Self) -> Selfwhere
Self: Sized,
fn max(self, other: Self) -> Selfwhere Self: Sized,
source§impl<'life> PartialEq<Iframe<'life>> for Iframe<'life>
impl<'life> PartialEq<Iframe<'life>> for Iframe<'life>
source§impl<'life> PartialOrd<Iframe<'life>> for Iframe<'life>
impl<'life> PartialOrd<Iframe<'life>> for Iframe<'life>
1.0.0 · source§fn le(&self, other: &Rhs) -> bool
fn le(&self, other: &Rhs) -> bool
self
and other
) and is used by the <=
operator. Read more