CSP Allow-list Experiment
Use the CSP Allow‑list Experiment to intercept CSP errors in sandboxed iframes and prompt users to add domains to the allow‑list.
Test the CSP Allow‑list Experiment in your own sandboxed iframe setup to ensure CSP errors are caught and users can add domains.
Summary
Article 2 introduces the CSP Allow‑list Experiment, a web tool that demonstrates how to load an application inside a CSP‑protected sandboxed iframe while still allowing dynamic fetch requests. The experiment intercepts CSP errors via a custom fetch() implementation and forwards them to the parent window, which then prompts the user to add the offending domain to a connect‑src allow‑list. Once the domain is added, the page can be refreshed to restore normal operation. The tool also provides controls to reset the sample, clear the allow‑list, and refresh the preview, making it easy to test different CSP configurations. The interface displays a modal dialog that lists the blocked origin, such as https://api.inaturalist.org, and offers a checkbox to suppress future prompts. The experiment was built using GPT‑5.5 xhigh in the Codex desktop app, illustrating how large‑language‑model assistance can accelerate security tooling. The screenshot shows the tool’s code editor, preview pane, and the allow‑list input field where users can add origins like https://api.github.com.
Key changes
- Loads an app inside a CSP‑protected sandboxed iframe
- Custom fetch() intercepts CSP errors and forwards them to the parent
- Parent prompts user to add offending domain to connect‑src allow‑list
- Page can be refreshed after adding the domain
- Controls to reset sample, clear allow‑list, and refresh preview
- Modal dialog lists blocked origin and offers suppression checkbox
- Built with GPT‑5.5 xhigh in Codex desktop app
- Allows adding origins like https://api.github.com