Re: CSP Directive Proposal: Sandbox

So, the moment I say "sandbox", I get several new restrictions that I
wasn't expecting:

1. When sandbox kicks in, I get a unique origin right?

2.  If I want to use a sandbox rule, such as.. allow-top-navigation, I
will have to do "allow-forms" as well, or mysteriously, my forms will
stop working.

3. If I want to use allow-top-navigation and allow Flash, how can I do
that? With CSP alone, I can.. but if you add sandbox, then there's no

Anyways, I'm not saying it's bad idea, I like it.. it's just that it
may get so complicated to get right, that no one will end up using it.


-- Eduardo

On Mon, Feb 21, 2011 at 12:20 PM, Adam Barth <> wrote:
> On Mon, Feb 21, 2011 at 11:38 AM, <> wrote:
>> Oh btw, regarding this idea of putting sandbox in a CSP rule.
>> I like it. But I would have preferred if it was the other way around..
>> And let a sandboxed iframe to have CSP rules.
>> Either way, If we have:
>> CSP: sandbox;script-src http://*
>> What will happen? The rules conflict with each other. I know the
>> answer will be, that no scripts will be allowed.. but that's counter
>> intuitive..
> It seems relatively intuitive.  Just think of each CSP directive as
> forbidding things.  Then it's easy to understand how the directives
> combine.
>> What about
>> CSP: sandbox allow-scripts;
>> Then script-src and inline-script rules are useless?
> The script-src and inline-script directives still work fine in that
> scenario.  Keep in mind that we need to have the interaction between
> CSP and iframe@sandbox be well-defined and sensible because they're
> already easy to combine even without the sandbox directive in CSP.
> Adam
>> On Mon, Feb 21, 2011 at 11:33 AM, gaz Heyes <> wrote:
>>> On 21 February 2011 19:21, <> wrote:
>>>> Would be cool if we had a "disallow-navigation" rule which disallow's
>>>> the user to navigate to any links.
>>> +1
>>> Same domain navigations restrictions would be awesome

Received on Tuesday, 22 February 2011 00:38:32 UTC