title: How to use CSPs on iFrames
body: <p>I am using an iFrame to contain an external html source <code>https://good.com/main.html</code></p>
  
  <pre><code>&lt;iframe src=“https://good.com/main.html" scrolling="no" style="overflow: hidden; height: 700px;"&gt;&lt;/iframe&gt;
  </code></pre>
  
  <p>But <code>good.com/main.html</code> imports and executes the following javascript</p>
  
  <pre><code>https://good.com/a.js
  https://good.com/b.js
  https://bad.com/c.js
  </code></pre>
  
  <p>Is there a way to prevent <code>good.com/main.html</code> importing and executing <code>bad.com/c.js</code>? More specifically, prevent any resource that does not have the same domain as <code>https://good.com</code>?</p>
  
  <p>I tried <em>sandboxing</em> the iFrame </p>
  
  <pre><code>&lt;iframe sandbox=“allow-same-origin allow-scripts” src=“https://good.com/main.html” scrolling="no" style="overflow: hidden; height: 700px;"&gt;&lt;/iframe&gt;
  </code></pre>
  
  <p>But it still imports and executes the <code>https://bad.com/c.js</code></p>
  
  <p><em>Is there a way to prevent the source from importing and executing any external js?</em></p>
  
  <p>I read about <a href="https://w3c.github.io/webappsec-cspee/" rel="nofollow noreferrer">CSPs on iFrames</a>, but I am unsure of it’s usage.</p>