Web Security · Senior · Question 27 of 75

What attributes should an iframe that shows untrusted user HTML have?

1None, iframes are isolated by default
2sandbox="allow-scripts allow-same-origin" to keep it working
✓Correct answer: sandbox without allow-same-origin (and preferably a separate origin), so the content can't access your app

Explanation

allow-scripts together with allow-same-origin on the same origin lets the framed code remove its own sandbox.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.