Skip to main content

Webview embedding

Webview embeds an HTTPS page in a sandboxed iframe.

Attributes

Default Allow:
Sandbox only accepts the safe allowlist; allow-same-origin, allow-top-navigation, and allow-popups-to-escape-sandbox are never exposed. Example:
Cross-origin iframe clicks cannot be intercepted by the parent, so there is no iframe parameter that makes links open in the system browser:
  • target="_self": navigates inside the iframe.
  • target="_blank": controlled by the Popups sandbox token; without Popups, no popup opens.
  • To force external links into the system browser, use a backend proxy that rewrites the page, or a native Webview with a navigation hook; a plain iframe cannot do it safely.

Security boundaries

  • Src must be HTTPS and its host must be confirmed in the editor.
  • The iframe uses sandbox="allow-scripts allow-forms allow-popups allow-downloads" and never allow-same-origin, so it cannot access the launcher page; popups also stay sandboxed.
  • file:, data:, and local paths are rejected.
  • Sites may block embedding through X-Frame-Options or CSP; use OpenUrl to open them externally.
  • Dynamic Src hosts must still be confirmed in the widget hosts, or the frame will not render.

Layout

Webview is a fixed-height block. Let the outer Container clip or scroll; do not rely on the iframe to resize the widget.