I’m building a dashboard on my site so my customers can more easily visualize their data. I’m going to provide graphing widgets which the customer will be able to configure to view their data however they like.

I would also like to allow my users to provide their own widgets which they can upload to a registry I control, and then view those widgets in their dashboards.

I was thinking of using web components as the interface for widgets. Is it possible to sandbox web components similar to how a iframe would be sandboxed? I don’t want user-provided widgets to be able to access cookies or other data on the page. I also can not manually audit every version of every widget that gets pushed to the registry.