Security/CSP/Sandbox

Overview

In this design, the content restrictions are based on the "sandbox" attribute of frames in HTML5.

Syntax

An HTTP server can deliver a policy to the browser by including a header named X-Sandbox. The X-Sandbox header as the following syntax:

content-security-policy = "x-sandbox" ":" OWS directive-list OWS
directive-list          = directive [SP directive-list]
directive               = "allow-same-origin" / "allow-forms" / "allow-scripts"

The user agent MUST ignore any X-Sandbox header fields occurring in an HTML meta tag or in the Trailer headers. The syntax and semantics of the directives are described in the following sections.

Semantics

ggg

sandbox attributedd.