title: How to allow only whitelisted resources (scripts, pixels etc.) to run within a sandboxed iframe?
body: <p>I am looking for an approach to allow only whitelisted scripts to run within a sandboxed iframe. I was thinking of an iframe-sandbox directive that allows only whitelisted scripts to run within an iframe. The analogy is the script-src directive in the Content Security Policy.</p>
  
  <p>The problem: </p>
  
  <pre><code>&lt;iframe sandbox="allow-same-origin allow-scripts" src="https://app.thirdparty.com" width="100%" height="800" frameBorder="0"&gt;&lt;/iframe&gt;
  </code></pre>
  
  <p>The app in the iframe provides valuable functionality for my website. However, it pulls in external resources that I would like to control (i.e., block), e.g., AnalyticsJavaScript.com and TrackingPixel.com. I would like to allow scripts from app.thirdparty.com but block AnalyticsJavaScript.com and TrackingPixel.com. </p>
  
  <p>Any help appreciated.</p>