iframe Sandbox
The iframe sandbox attribute imposes restrictions on embedded content (no scripts, forms, popups, same-origin), isolating untrusted embeds.
Purpose
To embed third-party content (ads, untrusted pages) safely by restricting its capabilities, preventing malicious-embed attacks.
Mechanism
<iframe sandbox="allow-scripts">: all restrictions apply by default; optionally relax with allow-scripts/allow-same-origin/allow-forms/allow-popups etc. Without allow-same-origin, the embedded content is treated as a different origin.
Use cases
- Safe third-party embedding
- Ad isolation
- iframe security