allow-storage-access-by-user-activation Experimental: Allows a document loaded in the to use the Storage Access API to request access to unpartitioned cookies.If this keyword is not used, this operation is not allowed. allow-scripts: Allows the page to run scripts (but not create pop-up windows).allow-same-origin: If this token is not used, the resource is treated as being from a special origin that always fails the same-origin policy (potentially preventing access to data storage/cookies and some JavaScript APIs).allow-presentation: Allows embedders to have control over whether an iframe can start a presentation session.This will allow, for example, a third-party advertisement to be safely sandboxed without forcing the same restrictions upon the page the ad links to. allow-popups-to-escape-sandbox: Allows a sandboxed document to open new windows without forcing the sandboxing flags upon them.If this keyword is not used, that functionality will silently fail. allow-popups: Allows popups (like from Window.open(), target="_blank", Window.showModalDialog()).allow-pointer-lock: Allows the page to use the Pointer Lock API.allow-orientation-lock: Lets the resource lock the screen orientation.It also allows the page to receive BeforeUnloadEvent event. allow-modals: Allows the page to open modal windows by Window.alert(), nfirm(), Window.print() and Window.prompt(), while opening a is allowed regardless of this keyword.If this keyword is not used, form will be displayed as normal, but submitting it will not trigger input validation, sending data to a web server or closing a dialog. allow-forms: Allows the page to submit forms.allow-downloads-without-user-activation Experimental: Allows for downloads to occur without a gesture from the user.This works regardless of whether the user clicked on the link, or JS code initiated it without user interaction. allow-downloads: Allows downloading files through an or element with the download attribute, as well as through the navigation that leads to a download of a file.The value of the attribute can either be empty to apply all restrictions, or space-separated tokens to lift particular restrictions: This value is unsafe, because it leaks origins and paths from TLS-protected resources to insecure origins.Ĭontrols the restrictions applied to the content embedded in the. unsafe-url: The referrer will include the origin and the path (but not the fragment, password, or username).
0 Comments
Leave a Reply. |