Safety
iframe sandbox vs CSP frame-ancestors
June 4, 2024
iframe sandbox vs CSP frame-ancestors is two directions of iframe policy. sandbox on your <iframe> limits what that child document may do (scripts, forms, top-navigation, same-origin access). CSP frame-ancestors — and X-Frame-Options — limit which sites may put your page in a frame. Sandbox does not stop someone else from framing you. frame-ancestors does not sandbox a widget you load from a CDN. Marketing sites that embed third-party HTML should sandbox it. Sites that must not be clickjacked need frame-ancestors. RoastMyOpsec grades framing headers on the landing HTML. It does not parse iframe sandbox flags, does not load child frames as an attack, and does not exploit clickjacking.
The practical difference
You control sandbox on tags you write. You control frame-ancestors on responses you send. A sandboxed ad iframe can still be a privacy problem; it is not a substitute for Permissions-Policy on camera and mic. allow-scripts + allow-same-origin together weaken sandbox — treat that combination as almost unsandboxed.
COOP and Origin-Agent-Cluster are process/opener isolation, not framing. See COOP vs COEP and OAC vs COOP.
How to choose a control
Your page must not be framed: frame-ancestors 'none' or 'self' (plus XFO as a belt). You embed untrusted HTML: sandbox without allow-same-origin unless you have a documented exception. You embed a trusted first-party widget: still prefer a tight sandbox and a CSP on the child origin.
| Control | Direction | Typical miss | Takeaway |
|---|---|---|---|
| iframe sandbox | Parent restricts child | allow-scripts + allow-same-origin | For embeds you include |
| CSP frame-ancestors | You restrict parents | Missing on the account origin | Clickjacking control |
| X-Frame-Options | You restrict parents (legacy) | Using it instead of CSP forever | Belt; see CSP vs XFO |
| COOP | Opener / context group | Treating it as framing | Different header |
What the roast can prove
Missing or weak framing headers on the landing response can surface. A sandbox attribute on a widget in the HTML is not scored. Confirm embeds in your templates. Pair with third-party trackers if the iframe is analytics.
Common mistakes
The first mistake is sandboxing ads and omitting frame-ancestors on /login.
The second mistake is allow-top-navigation on a sandboxed frame that you do not fully trust.
The third mistake is treating sandbox as a CSP for the parent page.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Does sandbox stop clickjacking of my site?
- No. Sandbox is for children you embed. Use frame-ancestors (and XFO) so others cannot frame you.
- Is allow-scripts + allow-same-origin safe?
- Together they largely undo sandbox. Avoid that pair unless you understand the child origin.
- Does RoastMyOpsec parse iframe sandbox?
- No. It grades framing headers on the landing response. No clickjacking payloads.