Security considerations in IFrame tag

The (Inline frame) tag is used to embed another HTML document or web resource inside the current webpage. It essentially creates a nested browser window within your layout.</p> <p>There are security risks that can be created by using iframes unless handled in the right manner. As an example, content that uses embedded external websites can create the risk of clickjacking or script injections. To counter these:</p> <ul> <li>Take a sandbox attribute to limit the frame behaviour (block scripts, forms, or popups).</li> <li>Never leave an unverified source dangling as src, or domain, etc.</li> <li>Integrate the sandbox with the ability to allow attributes to have more precise control. </li> </ul> <div class="highlight"><pre class="highlight html"><code><span class="nt">&lt;iframe</span> <span class="na">src=</span><span class="s">"https://www.youtube.com"</span> <span class="na">sandbox=</span><span class="s">"allow-scripts allow-same-origin"</span><span class="nt">&gt;&lt;/iframe&gt;</span> </code></pre></div> <p></p>

Comments

[Rahul S]

One thing worth flagging about that exact example: sandbox="allow-scripts allow-same-origin" together is the combination the sandbox spec explicitly warns against. Once a same-origin framed page has both, its own script can reach up to its frame element, strip the sandbox attribute, and reload itself right out of the box, so for anything you don't fully trust the sandbox is basically self-defeating. And it's worth being clear on direction too: sandbox only limits what the embedded page does to you, it does nothing to stop someone framing your page for clickjacking. That side needs a frame-ancestors CSP (or X-Frame-Options), which people often assume sandbox already covers.