# Iframe sandbox attribute
**URL:** https://talk.observablehq.com/t/iframe-sandbox-attribute/193
**Category:** Feedback
**Created:** [February 1, 2018, 8:45pm UTC](https://talk.observablehq.com/t/iframe-sandbox-attribute/193 "2018-02-01T20:45:30Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@mrdavidjcole](https://talk.observablehq.com/u/mrdavidjcole)
#### Post date: [February 1, 2018, 8:45pm UTC](https://talk.observablehq.com/t/iframe-sandbox-attribute/193/1 "2018-02-01T20:45:30Z")
Hi Observable friends,
I noticed that the main iframe for the rendered cell output has the following `sandbox` attribute:
```auto
sandbox="allow-scripts allow-popups allow-forms allow-popups-to-escape-sandbox allow-top-navigation-by-user-activation"
```
It seems that this breaks video playback in the Wistia player (disclosure: I work there), as seen in this notebook: [Using the Wistia oEmbed endpoint / David Cole | Observable](https://beta.observablehq.com/@mrdavidjcole/testing-observable-with-some-wistia-stuff).
I think that’s because Wistia, in most cases, delivers video using hls.js, which uses Media Source Extensions – and Media Source Extensions doesn’t play nice with that restriction. It appears to be struggling to construct the URL for the video’s `src` attribute. See the `null` in the error message:
```auto
Not allowed to load local resource: blob:null/e0de54c8-b258-4a5a-abb3-4a39c11088c6
```
After [a little experimentation in Glitch](https://wistia-iframe-sandbox-testing.glitch.me/), I found that including `allow-same-origin` in the `sandbox` attribute makes things work.
Would you be down to include that in the iframe’s sandbox attribute? If not, it’d be super helpful if you could help me understand why.
Thank you!
---
### Author:  [@jashkenas](https://talk.observablehq.com/u/jashkenas)
#### Post date: [February 1, 2018, 9:01pm UTC](https://talk.observablehq.com/t/iframe-sandbox-attribute/193/2 "2018-02-01T21:01:05Z")
_Edited, because my first answer was very wrong…_
We can’t add `allow-same-origin` to our `sandbox` attribute, because it would allow cookies, localStorage and sessionStorage to be shared (or interfered with) across notebooks. They’re all hosted on [observableusercontent.com](http://observableusercontent.com).
For example, if you embedded a video in a notebook that sets a cookie containing tracking information about what video you played — a completely unrelated notebook could then read that cookie information out later.
We’ve got some thoughts about potential ways to ease the sandboxing restrictions further, but we’re not ready to make a change quite yet.
Hope that helps!
---
### Author:  [@mrdavidjcole](https://talk.observablehq.com/u/mrdavidjcole)
#### Post date: [February 1, 2018, 9:09pm UTC](https://talk.observablehq.com/t/iframe-sandbox-attribute/193/3 "2018-02-01T21:09:55Z")
Thanks @jashkenas! I’ll see if we can find a way to detect this sort of thing from our end and (if we can do that) fall back to an alternative playback strategy.
---
### Author:  [@donmccurdy](https://talk.observablehq.com/u/donmccurdy)
#### Post date: [February 9, 2018, 5:35pm UTC](https://talk.observablehq.com/t/iframe-sandbox-attribute/193/4 "2018-02-09T17:35:17Z")
Thanks for the explanation @jashkenas — Lack of `allow-same-origin` seems to prevent me from using OAuth to Google APIs (like this [working example in Codepen](https://codepen.io/donmccurdy/pen/KQaGYB?editors=1000#)), so if there are ways to safely ease the restrictions in the future, that would be much appreciated!
---
### Author:  [@Fil](https://talk.observablehq.com/u/Fil)
#### Post date: [March 6, 2018, 8:54am UTC](https://talk.observablehq.com/t/iframe-sandbox-attribute/193/5 "2018-03-06T08:54:02Z")
Is this why no video embed codes seem to work? I’ve tried youtube & vimeo but no luck. The best I get is to display the interface (vimeo) - youtube has only a black rectangle.
html`\