Browser & Web Performance · Senior · Question 65 of 75

Why is a sandboxed iframe on a separate origin a common way to render untrusted HTML (e.g. user-generated widgets)?

<iframe sandbox="allow-scripts" src="https://usercontent.example-cdn.com/widget/42"></iframe>

1Iframes make the content load faster
2Sandboxed iframes can't execute JavaScript at all, even with allow-scripts
✓Correct answer: Code runs in another origin with restricted capabilities, so it can't access the app's DOM, cookies or storage

Explanation

This is why services host user content on separate domains. Never combine allow-scripts with allow-same-origin for same-origin content.

Further reading

Test yourself

Take the Browser & Web Performance · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.