HTML <iframe> sandboxAttribute
Examples
An <iframe> with extra restrictions:
Try it Yourself »
(More examples at the bottom of the page)
Browser Support
Internet Explorer 10, Firefox, Chrome, and Safari support the sandbox attribute.
Note:Opera and Internet Explorer 9 and earlier versions do not support the sandbox attribute.
Definition and Usage
If an empty string is specified (sandbox=""), the attribute enables some extra restrictions for the content rendered in the iframe frame.
The value of the sandbox attribute can be either an empty string (which enables all restrictions) or a space-separated list of specified strings.
HTML5 improves the security of iframes through the sandbox attribute. The sandbox attribute can prevent untrusted web pages from performing certain operations.
Ian Hickson, editor of the HTML5 specification, talked about the benefits of sandbox, which can prevent the following operations:
- Accessing the parent page's DOM (technically, this is because the iframe has become a different origin relative to the parent page)
- Executing scripts
- Embedding its own forms via scripts or manipulating forms
- Reading and writing cookies, local storage, or local SQL databases
Differences Between HTML 4.01 and HTML5
The sandbox attribute is a new attribute in HTML5.
Syntax
Attribute Values
| Value | Description |
|---|---|
| "" | Enables all restrictions |
| allow-same-origin | Allows the content to be treated as a normal source. If this keyword is not used, the embedded content will be treated as an independent origin. |
| allow-top-navigation | The embedded page's context can navigate (load) content into the top-level browsing context. If this keyword is not used, this operation will be unavailable. |
| allow-forms | Allows form submission. |
| allow-scripts | Allows script execution. |
More Examples
An <iframe> sandbox that allows form submission
Enables a series of extra restrictions but allows form submission.
An <iframe> sandbox that allows scripts and access to server content
Enables a series of extra restrictions but allows scripts and access to server content.
HTML <iframe> Tag Other extensions