Test 3 (srcdoc): CSP frame-src 'self' (Nested)

\n \n

CSP Header:

\n Content-Security-Policy: frame-src 'self'\n

\n\n

Expected Results:

• srcdoc iframe with nested external iframe: srcdoc content loads, but nested external iframe is blocked
• Direct external iframe: Should be blocked with CSP violation

\n\n

🔄 srcdoc with Nested iframe:

\n \n

\n This srcdoc iframe loads, but the external iframe inside it should be blocked.\n

\n\n

❌ Direct External iframe:

\n \n

\n This should be blocked by CSP and show an error in the console.\n

\n\n

🔍 Understanding srcdoc with CSP

\n The srcdoc attribute creates an inline document that inherits the parent's CSP policy. \n Unlike same-origin iframes loaded via URL, srcdoc content is considered part of the parent document's origin \n but still inherits CSP restrictions, so external iframes within srcdoc are blocked.\n

\n\n","deleted","label",[169,153],"frontend","permalink","https://www.val.town/x/paulkinlan/iframe-csp/code/frontend/test3-srcdoc.html","extension","html","actionData","errors"]