Security/CSP/Sandbox

Overview

In this design, the content restrictions are based on the "sandbox" attribute of frames in HTML5.

Syntax

An HTTP server can deliver a policy to the browser by including a header named X-Sandbox. The X-Sandbox header as the following syntax:

content-security-policy = "x-sandbox" ":" OWS directive-list OWS
directive-list          = directive [SP directive-list]
directive               = "allow-same-origin" / "allow-forms" / "allow-scripts"

ddd

Semantics

ggg