iframe sandbox

Description

The sandbox attribute applies restrictions to the HTML document. When the attribute is applied with no value, like this:

...
<iframe sandbox  name="myframe" width="300" height="100">
</iframe>
...

The following are disabled:

• scripts
• forms
• plugins
• links that target other browsing contexts

You can enable individual features by defining values for the sandbox attribute, like this:

...
<iframe sandbox="allow-forms" name="myframe" width="300" height="100">
</iframe>
...

The set of values that can be used is described in the following list.

• allow-forms - Enables forms
• allow-scripts - Enables scripts
• allow-top-navigation - Allows links that target the top-level browsing contexts, which allows the entire document to be replaced with another, or for a new tab or window to be created
• allow-same-origin - Allows content in the iframe to be treated as if it were from the same location as the rest of the document