
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@dimetrix/react-iframe
Advanced tools
A fully configurable React component that renders React components inside an isolated iframe
A fully configurable React component that renders React components inside an isolated iframe with complete style isolation and full React functionality.
component propnpm install @dimetrix/react-iframe
Peer Dependencies:
react ^17.0.0 || ^18.0.0 || ^19.0.0react-dom ^17.0.0 || ^18.0.0 || ^19.0.0import { ReactIframe } from '@dimetrix/react-iframe';
import MyComponent from './MyComponent';
function App() {
return (
<ReactIframe
component={MyComponent}
width="100%"
sandbox="allow-scripts allow-same-origin"
/>
);
}
Note:
autoHeightis enabled by default, so noheightprop is needed. The iframe will automatically adjust to match its content height.
import { ReactIframe } from '@dimetrix/react-iframe';
function App() {
return (
<ReactIframe width="100%">
<MyComponent />
</ReactIframe>
);
}
The ReactIframe component extends all standard HTML iframe attributes and adds the following props:
| Prop | Type | Default | Description |
|---|---|---|---|
component | ComponentType<Record<string, unknown>> | - | React component to render inside the iframe (alternative to children) |
children | ReactNode | - | React component(s) to render inside the iframe (alternative to component) |
componentProps | Record<string, unknown> | {} | Props to pass to the component rendered inside the iframe |
autoHeight | boolean | true | Automatically adjust iframe height to match content height (enabled by default) |
minHeight | number | 0 | Minimum height in pixels when autoHeight is enabled |
maxHeight | number | undefined | Maximum height in pixels when autoHeight is enabled |
...iframeProps | React.IframeHTMLAttributes | - | All standard HTML iframe attributes (see below) |
Important: Either
componentorchildrenmust be provided, but not both.
All standard HTML iframe attributes are supported and passed through to the underlying iframe element:
| Attribute | Type | Description |
|---|---|---|
sandbox | string | Security sandbox attributes (e.g., "allow-scripts allow-same-origin") |
allow | string | Feature policy (e.g., "camera; microphone; geolocation") |
allowFullScreen | boolean | Allow fullscreen mode |
referrerPolicy | string | Referrer policy ("no-referrer", "strict-origin-when-cross-origin", etc.) |
loading | "lazy" | "eager" | Lazy loading behavior |
name | string | Frame name for targeting |
width | string | number | Width (ignored when autoHeight is true) |
height | string | number | Height (ignored when autoHeight is true) |
title | string | Accessibility title |
className | string | CSS class name |
style | CSSProperties | Inline styles |
All standard React event handlers are supported:
onLoad - Fired when iframe loadsonError - Fired on iframe erroronFocus, onBlur - Focus eventsonMouseEnter, onMouseLeave - Mouse eventsdata-* attributesaria-* attributesimport { ReactIframe } from '@dimetrix/react-iframe';
import Counter from './Counter';
function App() {
return (
<ReactIframe
component={Counter}
width="100%"
sandbox="allow-scripts allow-same-origin"
title="Counter Component"
/>
);
}
import { ReactIframe } from '@dimetrix/react-iframe';
import UserProfile from './UserProfile';
function App() {
return (
<ReactIframe
component={UserProfile}
componentProps={{
userId: 123,
showEmail: true,
theme: 'dark'
}}
width="100%"
/>
);
}
import { ReactIframe } from '@dimetrix/react-iframe';
import DynamicContent from './DynamicContent';
function App() {
return (
<ReactIframe
component={DynamicContent}
width="100%"
minHeight={200}
maxHeight={1000}
// autoHeight is enabled by default
sandbox="allow-scripts allow-same-origin"
/>
);
}
The autoHeight prop automatically adjusts the iframe height to match its content, preventing vertical scrollbars. This is especially useful for dynamic content that changes size.
import { ReactIframe } from '@dimetrix/react-iframe';
import MyComponent from './MyComponent';
function App() {
return (
<ReactIframe
component={MyComponent}
width="100%"
height="400px"
autoHeight={false}
sandbox="allow-scripts allow-same-origin"
/>
);
}
import { ReactIframe } from '@dimetrix/react-iframe';
import MyComponent from './MyComponent';
function App() {
const handleLoad = (event: React.SyntheticEvent<HTMLIFrameElement>) => {
console.log('Iframe loaded successfully', event);
};
const handleError = (event: React.SyntheticEvent<HTMLIFrameElement>) => {
console.error('Iframe error', event);
};
return (
<ReactIframe
component={MyComponent}
width="600px"
height="400px"
sandbox="allow-scripts allow-same-origin allow-forms"
allow="camera; microphone; geolocation"
referrerPolicy="no-referrer"
loading="lazy"
title="My Isolated Component"
className="my-iframe-class"
style={{ border: '2px solid #ccc', borderRadius: '8px' }}
onLoad={handleLoad}
onError={handleError}
data-testid="my-component-iframe"
aria-label="Isolated React component"
/>
);
}
import { ReactIframe } from '@dimetrix/react-iframe';
function App() {
return (
<ReactIframe width="100%">
<div className="p-4 bg-blue-500 text-white rounded-lg">
<h1 className="text-2xl font-bold">Hello from iframe!</h1>
<p className="mt-2">Tailwind CSS works automatically inside the iframe.</p>
</div>
</ReactIframe>
);
}
Tailwind CSS is automatically injected into the iframe, so you can use Tailwind utility classes directly in your components.
import { useState } from 'react';
import { ReactIframe } from '@dimetrix/react-iframe';
import Counter from './Counter';
function App() {
const [count, setCount] = useState(0);
return (
<ReactIframe
component={Counter}
componentProps={{
initialCount: count,
onCountChange: setCount
}}
width="100%"
/>
);
}
ResizeObserver and MutationObserver to detect content size changes and adjust the iframe height accordingly with requestAnimationFrame throttling for optimal performanceReactDOM.createRoot to mount React components into the iframe's document<head>requestAnimationFrame to minimize performance impactEmbed React components as isolated widgets in third-party websites without style conflicts.
<ReactIframe
component={MyWidget}
width="100%"
sandbox="allow-scripts allow-same-origin"
/>
Test or preview components in isolation without affecting the parent application.
<ReactIframe
component={ComponentToTest}
width="100%"
sandbox="allow-scripts allow-same-origin"
/>
Render components with their own CSS that won't interfere with the parent page styles.
<ReactIframe width="100%">
<StyledComponent />
</ReactIframe>
Display content that changes size dynamically with automatic height adjustment.
<ReactIframe
component={DynamicContent}
width="100%"
minHeight={200}
maxHeight={1000}
/>
Full TypeScript support is included. Import types as needed:
import { ReactIframe, ReactIframeProps } from '@dimetrix/react-iframe';
// Use the type for props
const props: ReactIframeProps = {
component: MyComponent,
width: '100%',
autoHeight: true,
};
// Type-safe component
function MyApp() {
return <ReactIframe {...props} />;
}
Works in all modern browsers that support:
ResizeObserver (for auto-height feature, with fallback for older browsers)| Browser | Version |
|---|---|
| Chrome | 64+ |
| Firefox | 69+ |
| Safari | 13.1+ |
| Edge | 79+ |
See the example/ directory for a complete demo application showcasing:
To run the example:
cd example
npm install
npm run dev
When using the sandbox attribute, ensure you include allow-same-origin if you need to access the iframe's content:
// ✅ Good - allows script execution and same-origin access
sandbox="allow-scripts allow-same-origin"
// ❌ May not work - too restrictive for auto-height
sandbox="allow-scripts"
sandbox includes allow-same-origin if usedResizeObserver with optimized requestAnimationFrame throttlingcomponentProps are passed directly to your componentcomponentProps will trigger re-renders inside the iframeIf you see warnings about not being able to access iframe content:
Check your sandbox attribute - Ensure allow-same-origin is included:
sandbox="allow-scripts allow-same-origin"
Verify CORS settings - If loading from a different origin, check CORS headers
Check browser console - Look for specific error messages
autoHeight={true} is set (it's the default)sandbox includes allow-same-origin:
sandbox="allow-scripts allow-same-origin"
minHeight to see if the feature is working:
<ReactIframe minHeight={200} ... />
Styles inside the iframe are isolated. If you need to share styles:
If you experience performance issues:
autoHeight={false}minHeight and maxHeight to limit height calculationssandbox attribute to restrict iframe capabilitiesallow-same-origin - only use when necessaryreferrerPolicy to control referrer informationallow attribute to limit feature accessMIT License - see LICENSE file for details.
Contributions are welcome! Please feel free to submit a Pull Request.
git checkout -b feature/amazing-feature)git commit -m 'Add some amazing feature')git push origin feature/amazing-feature)# Clone the repository
git clone https://github.com/idimetrix/react-iframe.git
cd react-iframe
# Install dependencies
npm install
# Run development server
npm run dev
# Build the library
npm run build
# Run type checking
npm run typecheck
Made with ❤️ for the React community
FAQs
A fully configurable React component that renders React components inside an isolated iframe
We found that @dimetrix/react-iframe demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.