Can someone explain the issue behind the rule: "Sandboxed iframes with attributes ‘allow-scripts’ and ‘allow-same-origin’ are not allowed for security reasons."

Add-ons Development
3

Thank you Tom for the analysis! :slight_smile:

So any 3rd party page loaded into iframe can never remove the sandbox attribute, even if it’s set to “allow-same-origin allow-scripts”. Right?

So if this is not a security issue, why is it being enforced as “problem” by addon reviewers team?

I had one addon already removed from the store and a second one is now facing the same issue because of this rule. :frowning: