Suppose www.youtube.com have no X-Frame-Options set.

Imagine I'm already logged in to YouTube. Now from another web page in the same browser I'm loading YouTube in an iframe, will the browser send all the auth-cookies to the YouTube loaded in the iframe so that it will be loaded as logged in?

  • How about making a simple webpage with YouTube in an iframe and see what happens? Mar 28, 2018 at 19:12

1 Answer 1


By default, yes, though the sandbox parameter in the iframe tag can change this behavior.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .