telexed ~ c / b4649331-800radar:40 · otherLIVE
← back
NO.
#b4649331
Topic
OTHER
Source
Simon Willison
Published
2026-05-13 04:50:45
Importance
★ 4/10 — radar 40
`CSP Allow-list Experiment`: Interactive `fetch()` Recovery Inside Sandboxed `iframe`s
FIG-0461:1

`CSP Allow-list Experiment`: Interactive `fetch()` Recovery Inside Sandboxed `iframe`s

A sandboxed iframe can catch blocked fetch() attempts, ask the parent to whitelist the origin, then reload with updated connect-src. Useful pattern for shipping safer user-script sandboxes without hardcoding every API upfront.

[ KEY POINTS ]
  1. Runs apps under default-src 'none' in a sandboxed iframe, then escalates blocked network origins to the parent for approval.
  2. Blocked fetch() calls surface the exact failed origin, so users can add only that domain to connect-src instead of loosening CSP broadly.
  3. The flow includes prompt, allow-list update, and refresh, turning CSP failures into a usable permission UX rather than a dead end.
  4. Good fit for code playgrounds, HTML preview tools, and user-generated app builders where external API access is needed but must stay constrained.
Originalsimonwillison.net/2026/May/13/csp-allow/#atom-everythingRead original →

// related