I have page.html where there is following code:
<iframe srcdoc="<a href="javascript:console.log(1)">test</a>" sandbox="allow-same-origin || allow-scripts || allow-top-navigation || allow-popups"></iframe>I allow scripts, top-navigation and popups. When I load page.html in browser(Firefox Lastest), I can see hyper-link test in iframe, but here is the problem: when I click it - nothing appears in console(F12) while following code:
<iframe srcdoc="<script>console.log(1)</script>" sandbox="allow-scripts || allow-top-navigation || allow-popups"></iframe>Outputs "1" in console. Why wouldn't the javascript in a href work?
javascript:...)allow-same-origin: If this token is not used, the resource is treated as being from a special origin that always fails the same-origin policy. see MDN doc here