Skip to content
Novus Examples

Iframe sandbox

One frame document, four sandbox allow-lists. Each frame reports whether it could run a script, so the effect of the attribute is visible rather than assumed. SAMPLE content only.

Fully locked

sandbox=""

Scripts only

sandbox="allow-scripts"

Same-origin only

sandbox="allow-same-origin"

Scripts and forms

sandbox="allow-scripts allow-forms"

The document inside every frame is identical. Only the allow-list differs, so the line each frame shows is a direct read-out of what the attribute permitted.