All tools

iFrame & postMessage Tester

Test URL embedding, inspect cross-origin postMessage events, and configure sandbox security policies.

Network & APIs
Privacy: Client-Direct + Server-Proxy. Prefer browser fetch() to the IdP. On CORS failure or confidential clients, fall back to /api/v1/proxy/token. Credentials and assertions are not retained.

Debug SSO embeds, payment widgets, and postMessage bridges. Preview runs in your browser; framing header audits use a short-lived server probe for public URLs (localhost skipped).

Enter a URL and click Load

1280×720 · no sandbox

Sandbox policy

Without sandbox, the frame runs with the browser's default iframe privileges (still subject to the target's framing headers).

postMessage terminal

Incoming and outgoing messages appear here.

Why do iframes fail to embed?

Browsers refuse to frame pages that send X-Frame-Options: DENY/SAMEORIGIN or a restrictive Content-Security-Policy frame-ancestors directive. Mixed content (HTTPS parent embedding HTTP) also blanks the frame. SSO, OAuth widgets, and payment embeds hit these rules constantly.

This workbench loads a candidate URL in a controllable iframe, probes public framing headers via a short-lived proxy, simulates HTML sandbox permissions, and logs window.postMessage traffic so you can validate cross-origin contracts safely.

How to use this tool

  1. Paste a URL (or pick a preset), click Load / Audit headers, and read the embed verdict.
  2. Toggle sandbox flags and viewport size to mimic production embed constraints.
  3. Use the postMessage terminal to send JSON/string payloads and inspect inbound events from the frame.

Frequently asked questions

Can you probe localhost headers?

No — the server header probe blocks private hosts. You can still load http://localhost in the iframe from your browser for local widget testing.

Is framed content uploaded to stbox?

The live preview runs in your browser. Header audits fetch only framing-related response headers for public URLs and do not store bodies.

Why warn about allow-scripts + allow-same-origin?

Together they can let same-origin framed content remove the sandbox attribute, defeating the isolation model for untrusted embeds.