I have page.html where there is following code:

<iframe srcdoc="&lt;a href=&quot;javascript:console.log(1)&quot;&gt;test&lt;/a&gt;" sandbox="allow-same-origin || allow-scripts || allow-top-navigation || allow-popups"></iframe>

I allow scripts, top-navigation and popups. When I load page.html in browser(Firefox Lastest), I can see hyper-link test in iframe, but here is the problem: when I click it - nothing appears in console(F12) while following code:

<iframe srcdoc="&lt;script&gt;console.log(1)&lt;/script&gt;" sandbox="allow-scripts || allow-top-navigation || allow-popups"></iframe>

Outputs "1" in console. Why wouldn't the javascript in a href work?

CodePudding user response：

• You missed some code in your href (javascript:...)
• allow-same-origin: If this token is not used, the resource is treated as being from a special origin that always fails the same-origin policy. see MDN doc here