0. Co-Chairs Sean Snider, Yahoo! Prabhakar Goyal, Microsoft
Dec 11th, 2012
IAB SafeFrames
Co-Chairs
Sean Snider, Yahoo!
Prabhakar Goyal, Microsoft

1. SafeFrames: An Overview
What are SafeFrames?
A secure and flexible framework that provides the ability to create containers around HTML content served from sources external (e.g. Ad Server) to a host server (i.e. Publisher)

2. SF In-page Communication
Publisher Webpage
External Party Server
1. External Content Received (as data)
2. API Initiated
3. Vendor Content Rendered
SafeFrame
4. Communication

3. SafeFrames Technology
Host
External Content
Content Domain
Ads

4. SafeFrames Technology
Host
Host Secondary Domain
External Content
Content Domain
Where SafeFrame lives
Where external party content is served
Ads

5. SafeFrames Technology
Host
Safe-Frame API
Host Secondary Domain
External Content
Content Domain
Protocols for communication
Where SafeFrame lives
Where external party content is served
Ads

6. SafeFrames: Value Added
Consumer Safety
Host Benefits (i.e. Publisher)
Transparency
Control / Stability
External Party Benefits (i.e. Ad Agency)
More rich-media demand in more places
Standardized Functionality

7. SafeFrames: Consumer Safety
Content from un-vetted sources do not have direct access to the host web page
Cannot set/read host cookies without explicit publisher permission
Cannot set/read HTML form data
Proprietary rules can be implemented to further enhance security

8. SafeFrames: Transparency
Host web page has a container around content
Allows for geometric information about the external content to be easily measured and shared (e.g. viewability).
Meta-data passing between host and external content is explicitly defined
Both host and external content are aware of various rich-media functions

9. SafeFrames: Control / Stability
No JavaScript/CSS/HTML element name pollution
Host can measure performance easily
Rich-media functionality is clearly defined and known

10. Safe Frames: Standardization
Functionality clearly defined and is extensible over time
Rich-media
Meta-data
Host URL

11. SafeFrames: Host Decisions
Currently using iframe?
Yes No
Implement SafeFrame
Allowing rich media?
Yes* No
Does SafeFrame support my rich media types?
Yes

12. SafeFrames: External Party Decisions
Inside iframe? No
Use current behavior
Yes
Nested immediately under host?
window.parent == top No
Yes
Implement SafeFrame
$sf.ext JavaScript namespace exists? No
Yes

13. SafeFrames: Rich-Media Matrix