javascript - Is it safe to have sandbox="allow-scripts allow-popups allow-same-origin" on <iframe />?

Question

I'm dynamically creating an iframe in my app, result looks as follows:

<iframe src="blob:http%3A//localhost%3A9292/0194dfed-6255-4029-a767-c60156f3d359" 
        scrolling="no" sandbox="allow-scripts allow-popups allow-same-origin" 
        name="sandbox" style="width: 100%; height: 100%; border: 0px;"></iframe>

Is it safe to have such sandbox configuration (especially allowing the iframe content to be treated as being from the same origin)?

Answer 1

As commented by Namey, allow-same-origin will not allow the iframe to be treated as the from same origin as the parent and is safe to use (unless the parent and the iframe share the same origin, cf: warning on MDN).

As described by https://www.html5rocks.com/en/tutorials/security/sandboxed-iframes/#granular-control-over-capabilities:

The framed document is loaded into a unique origin, which means that all same-origin checks will fail; unique origins match no other origins ever, not even themselves. Among other impacts, this means that the document has no access to data stored in any origin’s cookies or any other storage mechanisms (DOM storage, Indexed DB, etc.).