Test 3 (Nested srcdoc): CSP frame-src 'self' (Triple Nested)

\n \n

CSP Header:

\n Content-Security-Policy: frame-src 'self'\n

\n\n

Expected Results:

• Same-origin iframe with nested srcdoc: Same-origin loads, srcdoc content loads
• External iframe within srcdoc: Should be blocked with CSP violation (triple nested)
• Direct external iframe: Should be blocked with CSP violation

\n\n

🔍 Triple Nesting Structure:

Level 1: Main page (CSP: frame-src 'self')

Level 2: Same-origin iframe (/hello-with-nested-srcdoc)

Level 3: srcdoc iframe within Level 2

Level 4: External iframe (https://paul.kinlan.me) within Level 3 srcdoc

\n\n

🔄 Same-Origin with Nested srcdoc:

\n \n

\n This same-origin iframe loads and contains a srcdoc iframe, but the external iframe within the srcdoc should be blocked.\n

\n\n

❌ Direct External iframe:

\n \n

\n This should be blocked by CSP and show an error in the console.\n

\n\n

🔍 Understanding Triple-Nested CSP

\n The CSP policy cascades through all iframe levels. Even though the srcdoc is nested within a same-origin iframe, \n it still inherits the original CSP policy from the top-level document, so external iframes at any nesting level are blocked.\n

\n\n","deleted","label",[169,153],"frontend","permalink","https://www.val.town/x/paulkinlan/iframe-csp/code/frontend/test3-nested-srcdoc.html","extension","html","actionData","errors"]