staticdata.dev
Menu
Datasets About Contact

iframe Sandbox Tokens

Every keyword token for the iframe sandbox attribute — the thirteen defined in the HTML Living Standard plus allow-storage-access-by-user-activation, defined by the Storage Access API. When the sandbox attribute is present without any tokens the iframe runs in the most restrictive mode; each allow-* token listed here selectively re-enables a specific browser capability for the embedded content.

v1.0.0 MIT 14 records Updated 2026-10-05 stable Source:  HTML Living Standard — The iframe element, MDN Web Docs — iframe sandbox

Quick fetch

Stable URL. CORS-enabled. No auth.

bash 
curl https://staticdata.dev/v1/iframe-sandbox-tokens.json

Or use as a typed import: import { iframeSandboxTokens } from "https://staticdata.dev/v1/iframe-sandbox-tokens.ts"

Formats

  • JSON 2.8 KB

    /v1/iframe-sandbox-tokens.json

    Open

    min: 2.5 KB · /v1/iframe-sandbox-tokens.min.json

  • CSV 2.2 KB

    /v1/iframe-sandbox-tokens.csv

    Open
  • TypeScript 3.0 KB

    /v1/iframe-sandbox-tokens.ts

    export const iframeSandboxTokens

    type SandboxToken = (typeof iframeSandboxTokens)[number]

    Open

Schema

Each record in the dataset has the following shape.

Schema
Field Type Description Example
token string The sandbox keyword token as used in the HTML attribute value allow-scripts
description string What capability the token grants when added to the sandbox attribute Allows the embedded page to run scripts.

Preview

First 10 records.

Data preview
tokendescription
allow-downloadsAllows the embedded browsing context to trigger file downloads. Without this token, download-initiating navigations are blocked.
allow-formsAllows the embedded page to submit forms. Without this token, form submissions are blocked.
allow-modalsAllows the embedded page to open modal windows via alert(), confirm(), prompt(), and the beforeunload event dialog.
allow-orientation-lockAllows the embedded page to lock the screen orientation using the Screen Orientation API.
allow-pointer-lockAllows the embedded page to use the Pointer Lock API to capture mouse movement.
allow-popupsAllows the embedded page to open new browsing contexts via window.open() or target="_blank" links. Without this token, such operations silently fail.
allow-popups-to-escape-sandboxAllows popups opened by the sandboxed page to escape the sandbox — the new browsing context does not inherit the sandbox restrictions.
allow-presentationAllows the embedded page to start a presentation session using the Presentation API.
allow-same-originAllows the content to be treated as being from its actual origin rather than a unique opaque origin. Without this token, the iframe's content is always treated as cross-origin, blocking access to same-origin cookies, storage, and the parent document.
allow-scriptsAllows the embedded page to run scripts (but not create popups). Without this token, all scripting is disabled.

Showing 10 of 14. View full data:  JSON · CSV

Fetch examples

Drop-in snippets in five languages.

curl 
curl -sSL https://staticdata.dev/v1/iframe-sandbox-tokens.json | jq '.[0]'
JavaScript 
import type { SandboxToken } from "https://staticdata.dev/v1/iframe-sandbox-tokens.ts";

const res = await fetch("https://staticdata.dev/v1/iframe-sandbox-tokens.min.json");
if (!res.ok) throw new Error(`Fetch failed: ${res.status}`);
const iframeSandboxTokens: SandboxToken[] = await res.json();
console.log(iframeSandboxTokens[0]);
Python 
import urllib.request, json

with urllib.request.urlopen("https://staticdata.dev/v1/iframe-sandbox-tokens.min.json") as r:
    iframeSandboxTokens = json.load(r)

print(iframeSandboxTokens[0])
Go 
package main

import (
	"encoding/json"
	"fmt"
	"net/http"
)

func main() {
	resp, err := http.Get("https://staticdata.dev/v1/iframe-sandbox-tokens.min.json")
	if err != nil { panic(err) }
	defer resp.Body.Close()

	var data []map[string]any
	if err := json.NewDecoder(resp.Body).Decode(&data); err != nil {
		panic(err)
	}
	fmt.Println(data[0])
}
Rust 
use serde_json::Value;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let body = ureq::get("https://staticdata.dev/v1/iframe-sandbox-tokens.min.json").call()?.into_string()?;
    let data: Vec<Value> = serde_json::from_str(&body)?;
    println!("{:?}", data.first());
    Ok(())
}

Sources and methodology

The tokens in this dataset are sourced from the HTML Living Standard maintained by WHATWG. The sandbox attribute on <iframe> imposes a set of restrictions on the embedded content by default; each allow-* token in this dataset selectively lifts one of those restrictions. When no tokens are present the iframe is maximally sandboxed — scripts, forms, popups, and same-origin access are all disabled. Tokens are space-separated and may be combined freely.

Developers most commonly reach for allow-scripts (to run JavaScript) and allow-same-origin (to preserve the content’s origin for storage and cookie access), but combining both of these tokens negates much of the sandbox’s security benefit because a script can then remove the sandbox entirely. The dataset covers all tokens in the HTML Living Standard as of October 2026, including newer additions such as allow-downloads and allow-top-navigation-to-custom-protocols, plus allow-storage-access-by-user-activation, which is defined by the Storage Access API rather than HTML.

Non-standard or browser-proprietary extensions to the sandbox token set are not included. Token availability may vary slightly across browser versions; the descriptions reflect the normative specification semantics. This dataset is equivalent in scope to the token list accepted by the CSP sandbox document directive, which mirrors the <iframe> sandbox attribute.

Versioning

URLs under /v1/ are stable: field names and types will not change in a way that breaks consumers. Values can be corrected or records added when the upstream source changes; schema-incompatible updates ship under a new version path. See the iframe-sandbox-tokens changelog for this dataset's history.

Related datasets

More Web datasets