CSP: sandbox

The HTTP Content-Security-Policy (CSP) sandbox directive enables a sandbox for the requested resource similar to the <iframe> sandbox attribute. It applies restrictions to a page's actions including preventing popups, preventing the execution of plugins and scripts, and enforcing a same-origin policy.

Syntax

Content-Security-Policy: sandbox;
Content-Security-Policy: sandbox <value>;

where <value> can optionally be one of the following values:

allow-downloads-without-user-activation

Allows for downloads to occur without a gesture from the user.

allow-forms

Allows the embedded browsing context to submit forms. If this keyword is not used, this operation is not allowed.

allow-modals

Allows the embedded browsing context to open modal windows.

allow-orientation-lock

Allows the embedded browsing context to disable the ability to lock the screen orientation.

allow-pointer-lock

Allows the embedded browsing context to use the Pointer Lock API.

allow-popups

Allows popups (like from window.open, target="_blank", showModalDialog). If this keyword is not used, that functionality will silently fail.

allow-popups-to-escape-sandbox

Allows a sandboxed document to open new windows without forcing the sandboxing flags upon them. This will allow, for example, a third-party advertisement to be safely sandboxed without forcing the same restrictions upon a landing page.

allow-presentation

Allows embedders to have control over whether an iframe can start a presentation session.

allow-same-origin

Allows the content to be treated as being from its normal origin. If this keyword is not used, the embedded content is treated as being from a unique origin.

allow-scripts

Allows the embedded browsing context to run scripts (but not create pop-up windows). If this keyword is not used, this operation is not allowed.

allow-storage-access-by-user-activation

Lets the resource request access to the parent's storage capabilities with the Storage Access API.

allow-top-navigation

Allows the embedded browsing context to navigate (load) content to the top-level browsing context. If this keyword is not used, this operation is not allowed.

allow-top-navigation-by-user-activation

Lets the resource navigate the top-level browsing context, but only if initiated by a user gesture.

Examples

Content-Security-Policy: sandbox allow-scripts;

Specifications

Browser compatibility

The compatibility table in this page is generated from structured data. If you'd like to contribute to the data, please check out https://github.com/mdn/browser-compat-data and send us a pull request.

See also

• Content-Security-Policy
• sandbox attribute on <iframe> elements