HTML <iframe>
sandbox
Attribute
Example
An <iframe>
with additional restrictions:
Browser Support
Internet Explorer 10, Firefox, Chrome, and Safari support the sandbox
attribute.
Note: Opera and Internet Explorer 9 and earlier versions do not support the sandbox
attribute.
Definition and Usage
If an empty string is specified (sandbox=""
), this attribute enables extra restrictions on the content displayed in the iframe.
The value of the sandbox
attribute can be an empty string (which enables all restrictions) or a space-separated list of predefined values.
HTML5 enhances iframe security with the sandbox
attribute. It prevents untrusted web pages from performing certain actions.
HTML5 specification editor Ian Hickson discusses the benefits of sandbox
, which prevents:
- Access to the parent page's DOM (technically, this is because the iframe becomes a different origin relative to the parent page)
- Script execution
- Embedding forms via scripts or manipulating forms
- Reading and writing cookies, local storage, or local SQL databases
Differences Between HTML 4.01 and HTML5
The sandbox
attribute is new in HTML5.
Syntax
Attribute Values
Value | Description |
---|---|
"" | Enables all restrictions |
allow-same-origin | Allows the content to be treated as being from its normal origin. If not used, the embedded content is treated as being from a unique origin. |
allow-top-navigation | Allows the embedded context to navigate (load) content into the top-level browsing context. If not used, this operation is not allowed. |
allow-forms | Allows form submission. |
allow-scripts | Allows script execution. |
More Examples
An <iframe>
sandbox allowing form submission
An <iframe>
sandbox allowing scripts and server access