Comparison
Clickjackingvsiframe sandbox
Clickjacking
your page was loaded in an invisible iframe over someone else's button, and the click landed on yours.
Framing a target site transparently over attacker-controlled content so the user's clicks are delivered to it unknowingly. The defence is refusing to be framed, with `frame-ancestors` in a Content Security Policy or the older `X-Frame-Options`. Any authenticated page that performs an action on click needs it, which in practice means the whole application.
Full entry →iframe sandbox
you embedded untrusted content and stripped its ability to run scripts, submit forms or navigate the top window.
An attribute that removes capabilities from framed content and puts it in an opaque origin, with permissions added back one token at a time. It is the standard containment for user-supplied HTML, previews and third-party widgets. Granting both `allow-scripts` and `allow-same-origin` to content from your own origin hands back the ability to remove the sandbox, which defeats the point.
Full entry →