If have a parent page that is served with the following CSP header:
CSP: sandbox allow-forms;
and within that parent page, I have an <iframe> has the following code –
<iframe sandbox="allow-downloads" src="https://someremotedomain.com" />
which sandbox attributes will be given precedence? In this particular example, will the iframe content be able to initiate downloads?
The parent CSP restrictions take precedence over the iframe’s sandbox attribute. in this case, downloads will be blocked because the parent CSP does not allow allow downloads.