Yaya kake haɗa abun ciki ta salama tare da iframe da sandbox?

Question

Accepted Answer

An ` ``` ## Yaya sandbox ke aiki `sandbox` ba tare da **darajas** ba yana amfani da *matsakaici* alluska: babu scripts, babu fomu, babu popups, yana jira abin ciki a matsayin nufin ainihi. Sai kuma ka **saka-saka maimaiti** iyawa ta hanyar jera tokens: ```html ``` Tokens na yada: - `allow-scripts` — bai shi tunkarar JavaScript. - `allow-forms` — bai shi shigar fomu. - `allow-same-origin` — jiyya asalensa (ba tare da haka ba shine null origin, tsakiyar adashi/cookies). - `allow-popups`, `allow-modals`, `allow-top-navigation`. **Shawarar salama:** danganta `allow-scripts` **da** `allow-same-origin` yana bai frame damar kawar da sandbox nasu idan shi ne same-origin — gida wannan tunaninsa don abin da ba a yarda dashi ba. ## Wasu sifofin salama ```html ``` ## Me ya sa ya mahimmanci Iframes suka haɗa abin da jiya-jiyan pati ko abin da mai amfani ke yin da ba ka sarrafa shi ba kuma ba sai ka yarda shi sosai. `sandbox` (ki-kawar da tsade, bar abin da ake buƙata) da `referrerpolicy`/`allow` yana bai ka damar tsare wannan abin - yana taba sa gudna jinya marubuta, taba sa ba da lamba baka shafi, ko taba sa damar kaɗa fasaha ta na'ura. Dauki `title` don sakattarwa da `loading="lazy"` don karfin aiki.