Iframes

If you’ve ever embedded a PDF, DOCX, or PPTX with Google Docs Viewer, you’ve probably hit the same wall everyone does: your Content Security Policy breaks it. That’s not a bug. That’s CSP doing its job. The annoying part is that Google Docs Viewer sits in an awkward middle ground. It’s convenient, familiar, and dead simple to drop into an <iframe>. But once you care about a tight CSP, third-party framing gets messy fast. You have to decide how much trust you want to hand to Google for a document-rendering feature that may not even be essential. ...

Loom embeds look simple: paste an iframe, ship it, move on. Then CSP blocks it, the video area goes blank, and somebody “fixes” it by slapping https: into frame-src or loosening half the policy. I’ve seen this happen more than once. Loom is exactly the kind of third-party embed that exposes weak CSP habits: developers guess at directives, over-allow sources, or forget that an iframe usually pulls in more than one origin. ...