> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qomicex.top/llms.txt
> Use this file to discover all available pages before exploring further.

# Webview embedding

## Webview embedding

`Webview` embeds an HTTPS page in a sandboxed iframe.

```xml theme={null}
<Webview
  Src="https://example.com/embed"
  Height="320"
  Title="Announcement"
/>
```

## Attributes

| Attribute | Values | Default | Description |
| :- | :- | :- | :- |
| `Src` | HTTPS URL or binding | Required | HTTPS:443 only |
| `Height` | 80–4000 px | `320` | iframe height |
| `Title` | string | `QWidget webview` | iframe title |
| `Allow` | string | see below | iframe `allow` features |
| `Sandbox` | `Scripts` / `Forms` / `Popups` / `Downloads` / `Modals` / `OrientationLock` / `PointerLock` / `Presentation` | `Scripts,Forms,Popups,Downloads` | iframe sandbox allowlist |
| `Loading` | `Lazy` / `Eager` | `Lazy` | iframe loading mode |
| `ReferrerPolicy` | `NoReferrer` / `NoReferrerWhenDowngrade` / `Origin` / `OriginWhenCrossOrigin` / `SameOrigin` / `StrictOrigin` / `StrictOriginWhenCrossOrigin` | `NoReferrer` | referrer policy |
| `Fullscreen` | `True` / `False` | `True` | allow fullscreen |

Default `Allow`:

```text theme={null}
fullscreen; autoplay; encrypted-media; picture-in-picture; clipboard-write
```

`Sandbox` only accepts the safe allowlist; `allow-same-origin`, `allow-top-navigation`, and `allow-popups-to-escape-sandbox` are never exposed. Example:

```xml theme={null}
<Webview Src="https://example.com/embed" Height="320"
         Sandbox="Scripts,Forms,Downloads"
         Loading="Eager" ReferrerPolicy="NoReferrer" Fullscreen="False" />
```

## Link behavior

Cross-origin iframe clicks cannot be intercepted by the parent, so there is no iframe parameter that makes links open in the system browser:

* `target="_self"`: navigates inside the iframe.
* `target="_blank"`: controlled by the `Popups` sandbox token; without `Popups`, no popup opens.
* To force external links into the system browser, use a backend proxy that rewrites the page, or a native Webview with a navigation hook; a plain iframe cannot do it safely.

## Security boundaries

* `Src` must be HTTPS and its host must be confirmed in the editor.
* The iframe uses `sandbox="allow-scripts allow-forms allow-popups allow-downloads"` and never `allow-same-origin`, so it cannot access the launcher page; popups also stay sandboxed.
* `file:`, `data:`, and local paths are rejected.
* Sites may block embedding through `X-Frame-Options` or CSP; use `OpenUrl` to open them externally.
* Dynamic `Src` hosts must still be confirmed in the widget `hosts`, or the frame will not render.

## Layout

`Webview` is a fixed-height block. Let the outer `Container` clip or scroll; do not rely on the iframe to resize the widget.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.