Blocking framebusting with javascript by using the HTML5
sandbox
This page includes the iframe framebuster.html which will try to bust out of its frame.
The HTML5 sandbox feature can prevent any
included iframes from trying to bust out of their frame,
as shown below. This can be done by the
default sandbox option, which not allow any scripts to
run. Below the framebuster.html frame is included
twice,
- first as sandboxed iframe not allowed to execute
JavaScript (so you will not see the animation of the moving dot),
-
then as sandboxed iframe that is allowed to execute JavaScript
(so you see the moving dot, but the frame does not have
permission to bust out of its iframe).
Even if we allow scripts to run in the iframe, with
sandbox="allow-scripts", the iframe is still not
allowed to navigate up to its parent, as shown below