title: Is <iframe> the only way to implement external apps for WebOS?
body: <p>I'm working on project, where we're trying to implement something similar to the WebOS. Several people are providing the idea to load external applications using the <code>&lt;iframe&gt;</code>.</p>
  
  <p>I've search and found: <a href="https://osjsv2.0o.no/" rel="nofollow noreferrer">https://osjsv2.0o.no/</a> , this project also uses  (you many inspect DOM in demo to see it).</p>
  
  <p>But, as for me, I found this idea rather bad, because as I understand  is secure only when cross domain is forbidden (<code>parent.document</code> won't be accessed).</p>
  
  <p>If there is some kind of JavaScript API, which is accessible in parent document, but it's inaccessible due disallowed cross-domain option for <code>&lt;iframe&gt;</code> - you won't be able to use some kind of this JS API.</p>
  
  <p>Won't be the way of virtualizing the parent DOM (encapsulating) and messaging via <code>Web-Workers</code> with using the structured clone algorithm more clever and safe way?</p>
  
  <p>Also, it's necessary to mention about security. If cross-domain communication is allowed between <code>&lt;iframe&gt;</code> and parent document - there is a possible issue, that attacker could load JSON in <code>&lt;iframe&gt;</code> app, which will break parent DOM or make some spy-stuff for inputs or other...</p>
  
  <p>So, the main question is: <strong>Is the <code>&lt;iframe&gt;</code> secure and the only way to load external apps in Web OS (like the <code>OS.js</code>) in 2016 (soon 2017) year?</strong></p>
  
  <p>Thanks</p>