How does a sandboxed iframe game embed work?

Embedding a game someone else wrote means running untrusted code on your page. A sandboxed iframe is how the web makes that safe. Here is what the pieces do.

What is a sandboxed iframe?

An iframe embeds one web page inside another. Adding the sandbox attribute strips that embedded page of nearly every permission — scripts, forms, popups, and more are all switched off. The host then adds back only the specific permissions the embed genuinely needs. It is a deny-by-default box.

Why do game platforms sandbox embeds?

A published game is code written by someone else. Without a sandbox, that code could read the host page, redirect the visitor, or interfere with other content. The sandbox removes those abilities up front, so a game platform can host thousands of games from many creators without auditing every line. The isolation is what makes open publishing practical.

What does allow-scripts actually permit?

A game needs to run JavaScript, so the host grants allow-scripts — and, for most single-file games, nothing else. The game can draw, animate, and respond to input. It cannot navigate the top window, submit forms to the host, or treat itself as same-origin with the embedding site. One permission in, everything else stays off.

Why serve the game from a separate origin?

Sandboxing is stronger when the embedded game also lives on its own domain. ArcadeLab renders games from play.arcadelab.ai, separate from the main arcadelab.ai site. The browser's same-origin policy then keeps the two apart by default, so the origin boundary backs up the sandbox attribute rather than relying on it alone.

How do I embed a sandboxed game in my site?

Point an iframe at the game's render URL on play.arcadelab.ai. The sandbox permissions are already set correctly, so the embed is safe to drop into a blog, a class page, or a portfolio. The network restrictions that pair with this are covered in what connect-src none does in an iframe CSP.

Have a game to embed? Publish it first at arcadelab.ai/publish.