Allow-forms allow-pointer-lock allow-same-origin allow-top-navigation

A sandbox attribute on a

Using sandbox

The sandbox attribute adds a group of restriction to the

the following restrictions apply:

• No script is executed, the browser behaves as if it couldn’t handle JavaScript
• AJAX requests can’t be initiated (the iframe has its own “origin”, different from your page, and thus violated the standard CORS mechanism respected by default by modern browsers)
• You limit the storage capabilities on the browser (eg: using cookies or localStorage is impossible)
• It’s impossible to create a new window, a popup
• Sending a form is prohibited
• Flash, Silverlight plugins, or Java applets are not loaded
• The Pointer Lock API (that provides information related to mouse movements) is blocked

Remove some restrictions

The sandbox attribute accepts multiple values that will allow you to relax the default policy as needed:

• allow-forms: form submission is allowed
• allow-scripts: scripts are executed
• allow-same-origin: the iframe uses the same “origin” that the page, so it no longer faces to CORS mechanism restrictions (permission to use AJAX requests, localStorage, cookies…)
• allow-top-navigation: the iframe can navigate to its top-level browsing context
• allow-popups: you can open a new window/a popup
• allow-pointer-lock: the Pointer Lock API is operable

Note that you can’t reauthorize plugins execution.

For example, if your iframe needs to open a popup to a third service, and requires authentication to access this service, you’ll have to add these values:

• allow-popup
• allow-same-origin
• allow-forms (the restriction applies to the iframe, but also to elements resulting)

Note that it’s not advisable to add both values allow-scripts and allow-same-origin: these two values will allow the iframe to access and modify your DOM. In this case, a malicious iframe could perform all sorts of operations, and could even remove its own sandbox attribute!

What is sandbox allow

Values of the sandbox Attribute Re-enables popups in a sandboxed iframe. allow-pointer-lock. Re-enables the Pointer Lock API (mouse movement capture) in sandboxed a iframe. allow-forms. Re-enables form submission in a sandboxed iframe.

What allows the iframe content to be treated as being from the same origin?

The allow-same-origin keyword allows the content to be treated as being from the same origin instead of forcing it into a unique origin, the allow-top-navigation keyword allows the content to navigate its top-level browsing context, and the allow-forms and allow-scripts keywords re-enable forms and scripts respectively ...

Are iFrames still used?

Finally, the