title: Sandboxing, IFrame, and allow-same-origin
body: <p>I have been reading about the HTML5 additions to the <code>&lt;iframe&gt;</code> tag. One of the additions is the inclusion of sandboxing flags that allow the document loaded into the <code>iframe</code> to interact with its parent browser context. </p>
  
  <p>After reading some of the documentation, I am looking for a bit of clarity. I have read <a href="https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#Attributes" rel="noreferrer">MDN's</a> description of the <code>allow-same-origin</code> flag: </p>
  
  <blockquote>
    <p>Allows the content to be treated as being from its normal origin. If
    this keyword is not used, the embedded content is treated as being
    from a unique origin.</p>
  </blockquote>
  
  <p>Not hugely, helpful, I think, after having read <a href="http://www.w3.org/html/wg/drafts/html/master/browsers.html#attr-iframe-sandbox-allow-same-origin" rel="noreferrer">W3C's</a> specification:</p>
  
  <blockquote>
    <p>...[I]t can be used to embed content from a third-party site,
    sandboxed to prevent that site from opening pop-up windows, etc,
    without preventing the embedded page from communicating back to its
    originating site, using the database APIs to store data, etc.</p>
  </blockquote>
  
  <p>My question is specifically about what MDN refers to as the "normal origin" in light of W3C's specification: when refering to the "normal origin" is MDN stating that the content of document contained within the <code>&lt;iframe&gt;</code> tag is treated as if it shares the origin of the page from which the document originates, e.g. a YouTube video believes - and can communicate as if - it is still apart of YouTube? Or, does the <code>&lt;iframe&gt;</code> document have access to the parent browser context?</p>