'Iframes in opened in new tab blocked from top level navigation
I'm confused about how the top-level browsing context works in chrome. As per this conversation, an opened window (C in the diagram from the link) has a top-level browsing context. I’ve been working on a similar setup.
I have an iframe(B) in window(A). Scripts in iframe(B) open a new window(C), which I assume to have a top-level browsing context.
If I am to include another iframe(D) in the opened window(C), which is not sandboxed at all, the content in the iframe should be able to perform top-level navigation in the opened page(C).
This behavior is in chrome, safari, and firefox and the top-level navigation requires the sandbox flags to be set on both iframes B and D. Can someone explain why these flags are required on iframe B even when B is not trying to do top-level navigation and top-level navigation done by D does not affect A?
Solution 1:[1]
Because it would require allow_top_navigation to be special cased, rather than being consistent with all the other sandbox permissions. There probably isn't a sufficiently good use case to justify such special casing.
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|---|
| Solution 1 | Alohci |