It would be great to easily extend the functionality onto iframes, that would allow greatly increasing sandboxing primitives currently present in the platform. We've heard multiple teams at Google that would love to see this feature implemented!
With the current proposal, there is no way for <iframe sandbox=... srcdoc=xxx> and <iframe sandbox=... src=data:text/html> to implement the Connection-Allowlist without encapsulating them with another, network-loaded iframe.
It should be enough to enable the support for it as part of <meta> in the <head> tag, but ideally a new attribute on the iframe would be more desirable. The issue with the new attribute on the iframe is that this feature could be then potentially used to selectively disable requests made by a cross-origin iframes, which might not be acceptable from the security PoV (csp= attribute had a similar issue which we then fixed).
It would be great to easily extend the functionality onto iframes, that would allow greatly increasing sandboxing primitives currently present in the platform. We've heard multiple teams at Google that would love to see this feature implemented!
With the current proposal, there is no way for
<iframe sandbox=... srcdoc=xxx>and<iframe sandbox=... src=data:text/html>to implement theConnection-Allowlistwithout encapsulating them with another, network-loaded iframe.It should be enough to enable the support for it as part of
<meta>in the<head>tag, but ideally a new attribute on the iframe would be more desirable. The issue with the new attribute on the iframe is that this feature could be then potentially used to selectively disable requests made by a cross-origin iframes, which might not be acceptable from the security PoV (csp=attribute had a similar issue which we then fixed).