Short answer (tl; dr):
Yes you can, adding the sandbox
attribute to the iframe.
Long answer:
A possible solution that html5 offers is the sandbox mode for iframe
. Being a sandbox, some operations will be restricted and can only be performed if it is specified in a variable. Examples of these operations ( you can see more in the definition of sandboxing ):
- communicate with the container
- initialize plugins
- create new contexts (← this is the part that interests you)
- send forms
- block the execution of scripts
To put a iframe
in sandbox mode, you just have to add the attribute sandbox
. You can leave it empty or add some permissions in token mode:
-
allow-forms
: to allow forms to be sent within iframe
-
allow-modals
: to allow modalities to be opened from the context of iframe
-
allow-popups
: to allow pop-ups, new windows / tabs, etc. If not indicated, it will fail without giving an error message
-
allow-scripts
: to allow you to run scripts
-
allow-presentation
: to allow the iframe
to initiate a presentation session
There are more possible values, although not all of them appear in the MDN Spanish translation linked above. If you are interested in the topic, you can read more in English at MDN or in the W3C definition .
So just putting the attribute sandbox
and the% page iframe
will not be able to open popups or new tabs / windows. And if you want to give permission, you can see the options that interest you to give them. As simple as this:
<iframe src="http://otrodominio.com/" sandbox>
</iframe>
WARNING : The sandbox
attribute is more or less extended and you should not have compatibility problems, but it will not work in older versions of IE (IE9 and below) and some of the tokens may not work in all browsers.