Harden Third-Party Iframes with Sandbox

Sandbox embedded iframes to the minimum tokens they need, never grant top navigation, and combine with a strict CSP allowlist.

~30 minsecuritywebiframe

Task

Embed a third-party iframe without granting it the ability to navigate or manipulate the parent page.

When to use this

An embedded third-party iframe runs with full privileges, so a compromised embed can navigate the top window or read storage.

Prerequisites

Control over the iframe markup
A CSP frame-src allowlist

Steps

1. Add a sandbox attribute with only the tokens the embed needs.

Expected output: The iframe loses all privileges not explicitly granted.

2. Never include allow-top-navigation or allow-top-navigation-by-user-activation.

Expected output: The embed cannot move the user away from your page.

3. Restrict frame-src in CSP to the specific embed origin.

Expected output: Only the intended embed can load.

4. Provide a no-sandbox fallback page or message if the embed breaks.

curl -sI https://app.example.com | grep -i frame-src

Expected output: Users get a clear experience rather than a blank frame.

Troubleshooting

Problem

Embed stops working

Solution

Add only the specific sandbox token required; do not remove the sandbox attribute entirely.

Problem

Payment or auth iframe needs same-origin

Solution

Use allow-same-origin only where the origin is trusted and isolated, and document the risk.

Limitations

allow-scripts plus allow-same-origin can let the frame escape the sandbox if it is same-origin with the parent.
Some third-party embeds require so many tokens that sandboxing offers little protection, which should be a conscious risk decision.

Context

Embed a third-party iframe without granting it the ability to navigate or manipulate the parent page. An embedded third-party iframe runs with full privileges, so a compromised embed can navigate the top window or read storage.

Steps

Add a sandbox attribute with only the tokens the embed needs. Expected: The iframe loses all privileges not explicitly granted.
Never include allow-top-navigation or allow-top-navigation-by-user-activation. Expected: The embed cannot move the user away from your page.
Restrict frame-src in CSP to the specific embed origin. Expected: Only the intended embed can load.
Provide a no-sandbox fallback page or message if the embed breaks. Expected: Users get a clear experience rather than a blank frame.

<iframe
  src="https://widget.example.com/embed"
  sandbox="allow-scripts allow-forms allow-popups"
  referrerpolicy="no-referrer"
  loading="lazy"></iframe>

Verify

The iframe loses all privileges not explicitly granted.
The embed cannot move the user away from your page.
Only the intended embed can load.
Users get a clear experience rather than a blank frame.

Limits

allow-scripts plus allow-same-origin can let the frame escape the sandbox if it is same-origin with the parent.
Some third-party embeds require so many tokens that sandboxing offers little protection, which should be a conscious risk decision.