Global Attributes & Iframe Security
12 min read
contenteditabledraggablehiddenspellchecksandboxreferrerpolicy
Global Attributes
These attributes can be used on ANY HTML element.
Key Global Attributes
| Attribute | Purpose | Use Case |
|---|---|---|
| contenteditable | Makes element editable | Inline editing, rich text editors |
| draggable | Enables native drag and drop | Reorderable lists |
| hidden | Hides element from rendering | Conditional display |
| spellcheck | Enables/disables browser spellcheck | Code editors (disable), text areas (enable) |
| translate | Indicates if content should be translated | Brand names, code (translate="no") |
| inert | Makes element and children non-interactive | Behind modals, disabled sections |
Iframe Security
Iframes are dangerous — they can execute scripts, navigate the parent page, and access cookies. The sandbox attribute restricts these capabilities.
Sandbox Flags
sandbox(no value): Blocks everythingallow-scripts: Allow JavaScriptallow-same-origin: Allow same-origin accessallow-forms: Allow form submissionallow-popups: Allow window.open
Warning: Never combine allow-scripts with allow-same-origin on untrusted content — the script can remove the sandbox.