What is a sandbox iframe?

A sandbox iframe is an HTML iframe carrying the `sandbox` attribute, which removes capabilities such as script execution, form submission and top-level navigation from the document rendered inside it.

Why it matters

DOM recording captures a customer's page as markup, and the player rebuilds that markup to show it. If the rebuilt page could run scripts, a recording would become a way to execute arbitrary code inside your dashboard, in front of every reviewer who opened it.

The sandbox attribute is the browser's own answer. Without allow-scripts, nothing in the frame executes, whatever the recording contains. allow-same-origin is still needed so the player can reach into the frame and apply events, but on its own it grants no execution.

How AnyReplay handles it

AnyReplay defends the player in three layers. First, rrweb replaces script bodies with SCRIPT_PLACEHOLDER at record time, so your JavaScript never leaves your page. Second, scripts are rebuilt as <noscript> on replay. Third, the replay iframe is sandboxed without allow-scripts; in a real browser it reports sandbox="allow-same-origin". rrweb only adds allow-scripts when UNSAFE_replayCanvas is on, which stays off, and a test in player.spec.ts fails the build if anyone turns it on. Chunk reads are organisation-scoped and a foreign resource answers 404, never 403. Your CSP covers the other direction.