Repository navigation
Example: Prebid as ad server with cross-origin (SafeFrame-style) rendering - #6864
Conversation
…rendering Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
✅ Deploy Preview for prebid-docs-preview ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9f85c1580b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| // A data: URL document has its own opaque origin, so the creative can't reach this page. | ||
| // allow-same-origin keeps that opaque origin (it doesn't grant this page's origin); it's needed | ||
| // because the creative script renders the ad in a nested frame it has to script. | ||
| iframe.sandbox = 'allow-scripts allow-same-origin allow-popups allow-popups-to-escape-sandbox allow-top-navigation-by-user-activation'; |
There was a problem hiding this comment.
When a rich-media winning creative submits an HTML <form>, this sandbox lacks allow-forms, so the browser blocks the submission; the base example this page claims to extend explicitly preserves that capability in dev-docs/examples/no-adserver.md:85-92. Users copying this variant will therefore get an ad that renders but cannot submit, so carry allow-forms into this token list (or document the intentional incompatibility).
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
🤖 This comment was written by an AI agent (Claude Code) on behalf of @patmmccann.
Agreed. Fixed in 244ee3b: allow-forms is added to the iframe's sandbox tokens, matching the base example; nothing else changed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Closes #5067.
Adds an example that extends Running Prebid.js as an ad server to render each winning ad in a cross-origin frame. The creative can't touch the publisher page, which is the isolation a SafeFrame provides, without an ad server or extra hosting.
How it works: each ad frame is a
data:URL document containing the creative script Prebid.js already uses for cross-domain rendering (integrationExamples/gpt/x-domain/creative.html), followed bypbRender({ adId, pubUrl }). The script asks the page's Prebid.js for the ad overpostMessagewith aMessageChannelport, then renders it inside the frame.adRenderSucceededandadRenderFailedfire as usual.Tested in headless Chrome with the page's own HTML and JS, assembled the way
_includes/code/web-example.htmldoes, using theprebid.js@latestnot-for-prod build and a debugging intercept for the bids:adRenderSucceeded).top.documentaccess throws, so the page isn't reachable.srcdociframe sandboxed withoutallow-same-originfails. The creative script's nested render frame gets a different opaque origin ("Blocked a frame with origin "null" from accessing a cross-origin frame"). The page explains whyallow-same-originis kept; on adata:document it keeps the frame's own opaque origin.Also checked on the Netlify preview: after loading the CMP-gated Prebid.js (v11.43 from the CDN), both ad units render in
data:frames and neither creative can reach the page. The docs site only loads Prebid.js after consent, so this example, like the existing one, does nothing until a visitor consents.The page's notes cover the limits:
localStorage. The alternative is hosting the creative document on a separate domain, the GAM SafeFrame model.$sf.extAPI (expand, geometry) isn't provided. That's what the proposed Secure Creative Rendering module (Secure Creative Rendering Module Prebid.js#15847) would add.Other details:
<as\x3Cin its string literals, because the include prints the JS unescaped in the "js" and "source" tabs. A literal<script>there would break the page.🤖 Generated with Claude Code