iframe sandbox in html Archives - scmGalaxy https://www.scmgalaxy.com/tutorials/tag/iframe-sandbox-in-html/ A Platform for Software Engineers Wed, 04 Aug 2021 10:05:51 +0000 en-US hourly 1 https://wordpress.org/?v=7.1 HTML: Sandbox https://www.scmgalaxy.com/tutorials/html-sandbox/ https://www.scmgalaxy.com/tutorials/html-sandbox/#respond Wed, 04 Aug 2021 10:05:49 +0000 https://www.scmgalaxy.com/tutorials/?p=7366 The restriction to the content such as disabling script or plugins is given by the internal frame. An iframe with […]

The post HTML: Sandbox appeared first on scmGalaxy.

]]> The restriction to the content such as disabling script or plugins is given by the internal frame.

An iframe with sandbox value as empty will have the following restrictions: –

  • Forms can not be submitted
  • Framed document cannot navigate its top level parent
  • Scripts are disabled
  • Stops frame content from using plugins
  • New windows(browsing contexts) cannot be created by the framed document
  • Framed content will be treated from an unique origin. Hence it will not have access to data stored in earlier cookies
  • Disable APIs
  • Automatically triggered features like auto playing videos etc are blocked

<iframe sandbox> </iframe>

Values

ValueDescription
(no value)Applies all restrictions
allow-formsRe-enables form submission
allow-pointer-lockRe-enables APIs
allow-popupsRe-enables popups
allow-same-originAllows the iframe content to be treated as being from the same origin
allow-scriptsRe-enables scripts
allow-top-navigationAllows the iframe content to navigate its top-level browsing context

allow-same-origin

A web page can have access to a second web page only if both have the same origin.

Uniform Resource Identifier (URI), Port Number, and HostName

Same-origin

  • https://www.google.com/p/contact-us.html
  • https://www.google.com/p/about-us.html

Different Port So Not in the Same Origin

  • https://www.google.com:82/p/contact-us.html
  • https://www.google.com/p/about-us.html

Different Host So Not in the Same Origin

  • https://en.www.google.com/p/contact-us.html
  • https://www.google.com/p/contact-us.html

allow-top-navigation

Top navigation allows us to open the linked document in the full body of the window or the top browsing context.

AttributeValueDescription
target_blank _parent _top framename _selfOpens the linked document in a new window or tab Opens the linked document in the parent frame Opens the linked document in the full body of the window Opens the linked document in a named frame Opens the linked document in the same frame as it was clicked (this is the default)

The post HTML: Sandbox appeared first on scmGalaxy.

]]> https://www.scmgalaxy.com/tutorials/html-sandbox/feed/ 0