iframe sandbox Token List Lookup
Classifies standard iframe sandbox tokens and resolves the scripts and origin restrictions imposed by this attribute alone. Omitted sandbox differs from an empty sandbox; inherited and CSP restrictions are outside this check.
Description
An iframe sandbox attribute applies restrictions, and allow tokens selectively relax them.
An iframe sandbox attribute applies restrictions, and allow tokens selectively relax them. Omitted sandbox and present-but-empty sandbox have very different effects.1
The tool returns unknown, scriptsRestricted, opaqueOriginRequired. The fields describe the supplied local pattern or effective state, or contain the formatted markup shown below.
When to use iframe sandbox Token List Lookup
Use this for the following task: Classifies standard iframe sandbox tokens and resolves the scripts and origin restrictions imposed by this attribute alone. Omitted sandbox differs from an empty sandbox; inherited and CSP restrictions are outside this check. Provide the requested local fields extracted from the relevant element or attribute.
How to use iframe sandbox Token List Lookup and understand its results
- Prepare the parsed element names, attribute values or direct element-child lists requested below. Keep attribute presence separate from its value.
- Enter present, tokens according to the field table, then run the tool.
- Read unknown, scriptsRestricted, opaqueOriginRequired. Check the effective state, recognized-token flags or generated markup against the rules below.
- Correct any reported local mismatch and check the resulting markup in its intended document and browser context.
| Input field | Meaning | Value type and bounds | Requirement |
|---|---|---|---|
| present | Present | boolean | Required |
| tokens | Tokens | string; maximum text length 100000 | Required |
Supply presence and token string. Split HTML ASCII whitespace, fold case and compare with the stored 13-token vocabulary. Return unique unknown tokens and these two restriction flags.
scriptsRestricted=present AND no allow-scripts; opaqueOriginRequired=present AND no allow-same-origin The symbols and boundary conditions refer to the supplied fields and the implementation described above.
| Output field | Meaning | Value type |
|---|---|---|
| unknown | Unknown | list of string |
| scriptsRestricted | Scripts Restricted | boolean |
| opaqueOriginRequired | Opaque Origin Required | boolean |
{
"input": {
"present": true,
"tokens": "allow-scripts allow-forms"
},
"output": {
"unknown": [],
"scriptsRestricted": false,
"opaqueOriginRequired": true
}
}Limitations and assumptions
The flags describe this attribute alone. Inherited sandbox restrictions and CSP are excluded; recognizing allow tokens is not a complete security assessment.
The tool does not fetch a page, run a browser or validate an entire HTML document. Malformed tool requests produce input errors; valid requests can still report unrecognized values or failed local checks.
Alternative or Complementary methods
Choose target=_blank rel=opener Security Check when you need its operation: Resolves opener behavior requested by an anchor with target=_blank under modern HTML rules. Implicit noopener applies unless opener is present; noreferrer or noopener takes precedence. Choose crossorigin anonymous/use-credentials Table for the complementary operation: Resolves a CORS settings attribute and potential-CORS request credentials mode for img/media without the same-origin fallback flag. Missing attribute means no-cors/include; empty or invalid present values mean cors/same-origin. Always-CORS features use a different mapping.
Background reference: HTML Standard: iframe sandbox Token List Lookup.
References
Similar or alternative tools
- target=_blank rel=opener Security Check
Resolves opener behavior requested by an anchor with target=_blank under modern HTML rules. Implicit noopener applies unless opener is present; noreferrer or noopener takes precedence.
- crossorigin anonymous/use-credentials Table
Resolves a CORS settings attribute and potential-CORS request credentials mode for img/media without the same-origin fallback flag. Missing attribute means no-cors/include; empty or invalid present values mean cors/same-origin. Always-CORS features use a different mapping.