stboxsandbox tools
All tools

iFrame & postMessage Tester

Test URL embedding, inspect cross-origin postMessage events, and configure sandbox security policies.

Network & APIs
Privacy: Client-Direct + Server-Proxy. Prefer browser fetch() to the IdP. On CORS failure or confidential clients, fall back to /api/v1/proxy/token. Credentials and assertions are not retained.

Debug SSO embeds, payment widgets, and postMessage bridges. Preview runs in your browser; framing header audits use a short-lived server probe for public URLs (localhost skipped).

Enter a URL and click Load

1280×720 · sandbox="allow-scripts allow-forms allow-popups"

Sandbox policy

postMessage terminal

Incoming and outgoing messages appear here.

Why do iframes fail to embed?

Browsers refuse to frame pages that send X-Frame-Options: DENY/SAMEORIGIN or a restrictive Content-Security-Policy frame-ancestors directive. Mixed content (HTTPS parent embedding HTTP) also blanks the frame. SSO, OAuth widgets, and payment embeds hit these rules constantly.

This workbench loads a candidate URL in a controllable iframe, probes public framing headers via a short-lived proxy, simulates HTML sandbox permissions, and logs window.postMessage traffic so you can validate cross-origin contracts safely.

How to use this tool

  1. Paste a URL (or pick a preset), click Load / Audit headers, and read the embed verdict.
  2. Toggle sandbox flags and viewport size to mimic production embed constraints.
  3. Use the postMessage terminal to send JSON/string payloads and inspect inbound events from the frame.

Frequently asked questions

Can you probe localhost headers?

No — the server header probe blocks private hosts. You can still load http://localhost in the iframe from your browser for local widget testing.

Is framed content uploaded to stbox?

The live preview runs in your browser. Header audits fetch only framing-related response headers for public URLs and do not store bodies.

Why warn about allow-scripts + allow-same-origin?

Together they can let same-origin framed content remove the sandbox attribute, defeating the isolation model for untrusted embeds.