目录搜索
GuidesAccess control CORSAuthenticationBrowser detection using the user agentCachingCaching FAQCompressionConditional requestsConnection management in HTTP 1.xContent negotiationContent negotiation: List of default Accept valuesCookiesCSPMessagesOverviewProtocol upgrade mechanismProxy servers and tunnelingProxy servers and tunneling: Proxy Auto-Configuration (PAC) filePublic Key PinningRange requestsRedirectionsResources and specificationsResources and URIsResponse codesServer-Side Access ControlSessionGuides: BasicsBasics of HTTPChoosing between www and non-www URLsData URIsEvolution of HTTPIdentifying resources on the WebMIME TypesMIME types: Complete list of MIME typesCSPContent-Security-PolicyContent-Security-Policy-Report-OnlyCSP: base-uriCSP: block-all-mixed-contentCSP: child-srcCSP: connect-srcCSP: default-srcCSP: font-srcCSP: form-actionCSP: frame-ancestorsCSP: frame-srcCSP: img-srcCSP: manifest-srcCSP: media-srcCSP: object-srcCSP: plugin-typesCSP: referrerCSP: report-uriCSP: require-sri-forCSP: sandboxCSP: script-srcCSP: style-srcCSP: upgrade-insecure-requestsCSP: worker-srcHeadersAcceptAccept-CharsetAccept-EncodingAccept-LanguageAccept-RangesAccess-Control-Allow-CredentialsAccess-Control-Allow-HeadersAccess-Control-Allow-MethodsAccess-Control-Allow-OriginAccess-Control-Expose-HeadersAccess-Control-Max-AgeAccess-Control-Request-HeadersAccess-Control-Request-MethodAgeAllowAuthorizationCache-ControlConnectionContent-DispositionContent-EncodingContent-LanguageContent-LengthContent-LocationContent-RangeContent-TypeCookieCookie2DateDNTETagExpectExpiresForwardedFromHeadersHostIf-MatchIf-Modified-SinceIf-None-MatchIf-RangeIf-Unmodified-SinceKeep-AliveLarge-AllocationLast-ModifiedLocationOriginPragmaProxy-AuthenticateProxy-AuthorizationPublic-Key-PinsPublic-Key-Pins-Report-OnlyRangeRefererReferrer-PolicyRetry-AfterServerSet-CookieSet-Cookie2SourceMapStrict-Transport-SecurityTETkTrailerTransfer-EncodingUpgrade-Insecure-RequestsUser-AgentUser-Agent: FirefoxVaryViaWarningWWW-AuthenticateX-Content-Type-OptionsX-DNS-Prefetch-ControlX-Forwarded-ForX-Forwarded-HostX-Forwarded-ProtoX-Frame-OptionsX-XSS-ProtectionMethodsCONNECTDELETEGETHEADMethodsOPTIONSPATCHPOSTPUTStatus100 Continue101 Switching Protocols200 OK201 Created202 Accepted203 Non-Authoritative Information204 No Content205 Reset Content206 Partial Content300 Multiple Choices301 Moved Permanently302 Found303 See Other304 Not Modified307 Temporary Redirect308 Permanent Redirect400 Bad Request401 Unauthorized403 Forbidden404 Not Found405 Method Not Allowed406 Not Acceptable407 Proxy Authentication Required408 Request Timeout409 Conflict410 Gone411 Length Required412 Precondition Failed413 Payload Too Large414 URI Too Long415 Unsupported Media Type416 Range Not Satisfiable417 Expectation Failed426 Upgrade Required428 Precondition Required429 Too Many Requests431 Request Header Fields Too Large451 Unavailable For Legal Reasons500 Internal Server Error501 Not Implemented502 Bad Gateway503 Service Unavailable504 Gateway Timeout505 HTTP Version Not Supported511 Network Authentication RequiredStatus
文字

HTTP Content-Security-Policy(CSP)sandbox伪指令为请求的资源启用类似于<iframe> sandbox属性的沙箱。它对页面的操作应用限制,包括阻止弹出窗口,阻止插件和脚本的执行以及强制执行同源策略。

CSP版本

1.1 / 2

指令类型

Document指令

| 此指令在<meta>元素或Content-Security-policy-Report-Only标题字段中不受支持。|

句法

Content-Security-Policy: sandbox;Content-Security-Policy: sandbox <value>;

where <value> can optionally be one of the following values:

allow-forms允许嵌入式浏览上下文提交表单。如果未使用此关键字,则不允许此操作。

allow-modals允许嵌入式浏览上下文打开模态窗口。

allow-orientation-lock允许嵌入式浏览上下文禁用锁定屏幕方向的功能。

allow-pointer-lock允许嵌入式浏览上下文使用指针锁定API。

allow-popups允许弹出窗口(像window.opentarget="_blank"showModalDialog)。如果未使用此关键字,则该功能将悄然失败。

allow-popups-to-escape-sandbox允许沙盒文档打开新窗口而不强制沙盒标记。例如,这将允许第三方广告安全地进行沙盒处理,而不会对登录页面强加相同的限制。

allow-presentation允许嵌入程序控制iframe是否可以启动演示会话。

allow-same-origin允许将内容视为来自其正常来源。如果未使用此关键字,则将嵌入内容视为来自唯一来源。

allow-scripts允许嵌入式浏览上下文运行脚本(但不能创建弹出窗口)。如果未使用此关键字,则不允许此操作。

allow-top-navigation允许嵌入式浏览上下文将内容导航(加载)到顶层浏览上下文。如果未使用此关键字,则不允许此操作。

示例

Content-Security-Policy: sandbox allow-scripts;

规范

规范

状态

评论

内容安全策略级别3该规范中“sandbox”的定义。

编辑草稿

没有变化。

内容安全策略级别2该规范中“sandbox”的定义。

建议

初始定义。

浏览器兼容性

特征

Chrome

Firefox

Edge

Internet Explorer

Opera

Safari

基本支持

25

50.0

14

10

15

7

特征

Android

Chrome for Android

Edge mobile

Firefox for Android

IE mobile

Opera Android

iOS Safari

基本支持

4.4

(Yes)

?

50.0

10

?

7.1

上一篇:下一篇: