CSP iframe Demo

\n \n

\n This demo tests different Content Security Policy (CSP) frame-src configurations:\n

\n\n

Test 1: frame-src 'none'

Blocks all iframes. Attempts to embed https://paul.kinlan.me

\n \n Run Test 1\n \n

\n\n

Test 2: frame-src 'self'

Allows same-origin iframes only. Tests both same-origin and external embeds.

\n \n Run Test 2\n \n

\n\n

Test 3: frame-src 'self' (Nested)

Same as Test 2, but embeds a same-origin page that itself contains an iframe to an external site.

\n \n Run Test 3\n \n

\n\n

💡 What to expect:

• Test 1: External iframe should be blocked (CSP violation)
• Test 2: Same-origin iframe works, external iframe blocked
• Test 3: Same-origin iframe works, but its nested external iframe is blocked
• Test 3 (srcdoc): srcdoc iframe works, but its nested external iframe is blocked
• Test 3 (Nested srcdoc): Same-origin iframe works, srcdoc works, but triple-nested external iframe is blocked

\n\n","deleted","label",[170,153],"frontend","permalink","https://www.val.town/x/paulkinlan/iframe-csp/code/frontend/index.html","extension","html","actionData","errors"]