I'm trying to set some CSP policies on my sandboxed iframe with allow scripts. Naturally meta tags wouldn't do the trick if the iframe itself has scripts enabled and can just remove the meta tags right? Is there a way to create the iframe with srcdoc and still set the CSP or do I have to load it from a server?
The csp attribute does apply to srcdoc iframes. Being a local scheme, no response headers are needed. Just writing <iframe csp="defaul-src 'none'" srcdoc="something"> will enforce that CSP on the iframe and I guess do more or less what you would like. This is specified here.
Keep in mind that the csp attribute is currently only implemented in chromium. Also notice that the behaviour for srcdoc was just fixed in M90. Prior to that, I believe chromium was incorrectly discarding the csp attribute for srcdoc iframes.