Browser & Web Performance · Senior · Question 66 of 75

Why is `allow-scripts allow-same-origin` on a sandboxed iframe with same-origin content dangerous?

1It disables CSP for the whole page
✓Correct answer: The framed script can reach into the parent and remove the sandbox attribute, escaping the sandbox
3The iframe will not load at all

Explanation

With both flags, same-origin content is effectively unsandboxed. Use a separate origin for untrusted content.

Further reading

Test yourself

Take the Browser & Web Performance · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.