Embedding and web termsUpdated
iframe sandbox attribute
Also called: sandbox attribute, sandboxed iframe, allow-scripts
Definition
The sandbox attribute on an <iframe> puts extra restrictions on the embedded page, such as blocking scripts, forms, pop-ups and navigation of the top window. An empty sandbox applies every restriction, and tokens like allow-scripts lift them one at a time.
Common tokens
| Token | Lets the framed page |
|---|---|
| (empty) | Nothing extra: every restriction applies |
| allow-scripts | Run JavaScript |
| allow-same-origin | Keep its real origin; without it, the frame is treated as an origin that fails every same-origin check, which can cut off storage and cookies |
| allow-popups | Open new windows or tabs, including links with target="_blank" |
| allow-popups-to-escape-sandbox | Open those windows without passing the sandbox on to them |
| allow-forms | Submit forms |
| allow-top-navigation | Navigate the whole browser tab away from your page |
When to use it
Sandboxing is most useful for content you can't vouch for: HTML submitted by users, ads, or third-party code that only needs to display something. Start with an empty sandbox and add tokens until the embed works.
MDN warns against combining allow-scripts and allow-same-origin when the framed page comes from your own origin, because the framed page could then remove the sandbox itself.
A sandbox doesn't replace other protections. It limits what the framed page can do, while a Content Security Policy limits what your page may load in the first place; sites that show untrusted content often use both.
Sandbox and third-party widgets
Widgets from a provider you've chosen usually need scripts to render and pop-ups to open links, so a strict sandbox shows a blank frame or links that silently do nothing. LinkedInEmbed's snippets don't add a sandbox. If you or your platform add one, include at least allow-scripts, allow-same-origin, allow-popups and allow-popups-to-escape-sandbox, then test that post links open normally. If you can't change the attribute yourself, ask the platform whether trusted embed providers can be exempted.
A blank embed has several possible causes besides a sandbox; this checklist goes through them in order.
Sources
Related terms
- iframe
- An iframe (inline frame) is an HTML element, <iframe>, that displays a separate web page inside the current one. The embedded page loads from its own address and runs as its own document, kept apart from the host page's styles and scripts.
- Content Security Policy (CSP)
- A Content Security Policy (CSP) is a set of rules a website sends to the browser, usually in a Content-Security-Policy header, saying which sources the page may load scripts, frames, images and other resources from. Anything not allowed is blocked.
- Third-party cookies
- A third-party cookie is a cookie set by a site other than the one in the browser's address bar, usually by content embedded from another domain such as an iframe or script. Browsers restrict them because they can be used to track people across sites.
- Embed code
- Embed code is a snippet of HTML you paste into a web page to display content hosted somewhere else, such as a video, a social media post or a widget. It's usually an iframe tag, a script tag with a placeholder element, or a combination.
Show your LinkedIn on your website
Paste a LinkedIn URL and embed it with one snippet. Free plan, no credit card.
Put your LinkedIn on your website today
Create your first widget in about two minutes. Free plan, no credit card required.