How can I restrict my iFrame to use only local (i.e. not from other websites) content? My question is the reverse of the question as how to restrict other sites from using my site in an iframe.
I am using Tomcat/Java/JSP.
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
You can set a Content-Security-Policy header with the
E.g., this will only allow frame content from the same domain:
Content-Security-Policy: child-src 'self'
'self' you can also specificy a particular origin.
Here is a simple demo (the meta tag is used to simulate the header). Only the first frame should load:
<meta http-equiv="Content-Security-Policy" content="child-src http://example.com/"> <iframe src="http://example.com/"></iframe> <iframe src="http://example.org/"></iframe>
Note that this works in Firefox and Chrome but isn't supported in IE/Edge.