Or at the very least with iframes. If you run a forum and you're allowing directly embedded content, you're trusting that content not to break your security.

I use Markdown for user content, this is passed through a Go library I wrote to strip out iframes, embeds, etc... https://github.com/microcosm-cc/bluemonday and then as a post-processing task once I trust the content, I find the links that I know how to handle (YouTube, Bikely, etc) and embed third party content in iframes.

This is basically a way to do the equivalent of Twitter cards, it respects the JavaScript and web security model, but does mean that the iframes contain http content on a page that is https

Where I'm trying to get to is to have all iframes, etc be https

> I find the links that I know how to handle (YouTube, Bikely, etc) and embed third party content in iframes.

Ah, that makes sense. From your previous comment, I didn't realize you were recognizing and explicitly handling sites like Bikely.

I think iframes will result in a embedded content warning?

Yes, they will, but they're an improvement over script tags (which will also result in a mixed-content warning).

Yes, they do.