iframe-csp-test
Val Town is a collaborative website to build and scale JavaScript apps.
Deploy APIs, crons, & store data – all from the browser, and deployed in milliseconds.
Viewing readonly version of main branch: v8View latest version
This is a simple website for testing Content Security Policy (CSP) permissions with iframes.
- Displays a webpage with text "Below is an iframe"
- Contains an iframe with
srcdoccontent that has:- Blue background
- Black text saying "hello from iframe"
- Served with multiple CSP headers to prevent iframe rendering
/frontend/index.html- Main HTML page with embedded iframe/backend/index.ts- Hono server that serves the HTML with CSP headers
The website is served with Content-Security-Policy: frame-src 'none' header, which should block iframe loading from external sources. However, srcdoc iframes may behave differently depending on the browser's CSP implementation.
Visit the HTTP endpoint to see the iframe test in action and observe how the browser handles the CSP policy with srcdoc iframes.