After adding sandbox to a third-party <iframe>, its form stops submitting, its "open in new tab" links do nothing, and its export button downloads nothing. Which sandbox tokens restore each behaviour, and what happens to a popup the frame does open?

## The debugging method A sandboxed embed fails **silently**. Forms do not submit and no error is thrown; `window.open` returns `null`; a download simply never starts. The browser's console usually does log a sandbox-related message, and that message names the missing token — reading it is faster than guessing. The discipline is: reproduce one broken behaviour, identify the single token that governs it, add that token, re-test. Never add three at once, and never respond to unexplained breakage by granting the most powerful token you can think of. ## Mapping symptoms to tokens - **A form inside the frame does not submit** → `allow-forms`. Note this covers submission specifically; typing into the fields was never blocked, which is why the failure looks like a broken button. - **`target="_blank"` links and `window.open` do nothing** → `allow-popups`. Without it `window.open` returns `null`, so widget code that does `const w = window.open(...); w.location = ...` throws a `TypeError` on the second line, which is often the first visible symptom. - **An export or "download PDF" button produces no file** → `allow-downloads`. Downloads are blocked in a sandboxed frame regardless of whether the frame's script ran. - **`alert`, `confirm`, `prompt` or `window.print()` are ignored** → `allow-modals`. - **The widget wants to send the whole tab somewhere** → `allow-top-navigation-by-user-activation` in preference to `allow-top-navigation`, so it can only happen off a real user gesture. - **The widget's own script does not run at all** → `allow-scripts`, which for any interactive third-party embed is table stakes. ## Popup inheritance — the part people miss Adding `allow-popups` gets the window to open, but that new window is **created with the opener frame's sandbox flags**. So the popup is itself sandboxed: no scripts if the frame had none, no forms if the frame had none, and an opaque origin. For an OAuth-style flow or a payment window this is usually fatal — the popup needs to be a normal document. That is what `allow-popups-to-escape-sandbox` is for: it says popups opened from this frame are created *without* the sandbox flags. It is a deliberately wide grant, because a frame you have contained can now open an uncontained window. Grant it only when you know why the popup needs it, and prefer restructuring — for instance, having your own page open the window rather than the embed — where that is possible. ## The finished element ```html <iframe src="https://widget.example/checkout" sandbox="allow-scripts allow-forms allow-popups allow-downloads" allow="payment 'src'" referrerpolicy="strict-origin" loading="lazy" title="Checkout widget"></iframe> ``` Read as four independent decisions: which baseline capabilities the document keeps (`sandbox`), which powerful feature is delegated (`allow`), how much referrer information its requests carry (`referrerpolicy`), and when it is fetched (`loading`). The `title` is not optional in practice — assistive technology announces frames by that string, and without it the user hears only that a frame exists. ## The token you should hesitate over Nothing in this symptom list is fixed by `allow-same-origin`. If someone reaches for it, the real question is what the widget is trying to do — usually read its own cookies or storage. That is a legitimate need for a genuinely third-party embed served from its own origin: `allow-same-origin` restores *the vendor's* origin, not yours, and the frame still cannot touch your page. It is only self-defeating when the framed content is served from your own origin, where combining it with `allow-scripts` puts the frame back inside your trust boundary. So the answer to "can I add it?" is a question about where the content is hosted, not about which symptom you are chasing. ## What to say when the vendor asks for everything A common real-world ending is the vendor's integration guide saying "do not sandbox our embed". Treat that as a negotiation, not a verdict: start from the token set that makes their demo work, hand them the list, and ask which specific token each of their remaining requirements needs. Most vendor guidance predates anyone asking. The token set you end up with is a documented contract about what that third party can do inside your page — which is exactly the artefact an interviewer wants to hear you produce.