Blog

Third-Party Scripts, iframes and postMessage: sandbox, frame-ancestors, Permissions-Policy and Safe Messaging

Third-party code added with a script tag runs in your origin with your authority; move it into a sandboxed iframe on its own origin, close your page to framing with the frame-ancestors header, switch off unused APIs with Permissions-Policy and validate origin, source window and schema in postMessage. We show each step with real output from headless Chrome and Vitest in a local three-origin lab.