CSP sandbox

Applies iframe sandbox restrictions to the document itself.

Falls back to

nothing — must be set explicitly

Group

Document and navigation directives

Detail

Takes the same tokens as the iframe sandbox attribute. An empty value is maximally restrictive: unique opaque origin, no script, no forms, no popups. Useful for serving untrusted user content. Be careful — sandbox with no allow-same-origin puts the document in an opaque origin, which breaks storage and cookies.

Example

Analyse a full policy → · Generate one →