Question About iframe Sandbox Differences Between Dev and Prod

[oladimeji-akande]

We’re currently experiencing an issue in the dev environment that does not occur in production. We’re attempting to navigate to a new window from within the Canvas iframe, but we’re encountering the following error in dev only:

“Unsafe attempt to initiate navigation for frame with origin 'https://company-dev.canvasmedical.com/' from frame with URL 'https://dev.company.com/'. The frame attempting navigation of the top-level window is sandboxed, but the flag of 'allow-top-navigation' or 'allow-top-navigation-by-user-activation' is not set.”

Could you confirm whether there are any differences in the iframe sandbox settings between the dev and prod Canvas environments?

[rmagier1]

Hi @oladimeji-akande — there's no environment-specific iframe sandbox config in Canvas. Dev and prod run identical code paths for building the iframe sandbox attribute. The difference you're seeing comes from how the loaded iframe URL matches your plugin manifest's url_permissions.

How the sandbox attribute is decided

Canvas renders the application iframe with a sandbox attribute only when the URL being loaded matches a url_permissions entry in your plugin manifest that grants ALLOW_SAME_ORIGIN. Matching is a case-insensitive prefix match of the loaded URL against the manifest entry URL.

• Match found, includes ALLOW_SAME_ORIGIN → iframe is rendered as:

  <iframe sandbox="allow-same-origin allow-forms allow-popups allow-scripts" …>

  This does not include allow-top-navigation or allow-top-navigation-by-user-activation, so top-frame navigation from inside the iframe is blocked — the error you're seeing.

• No match → iframe has no sandbox attribute at all → top-frame navigation works normally.

Why dev vs prod differ for you

It looks like your prod iframe URL isn't actually matching any of your manifest's url_permissions entries, while your dev URL is. When no entry matches, no permissions are applied, no sandbox attribute is rendered, and top-frame navigation works — which is why prod looks fine. Dev matches an entry that grants ALLOW_SAME_ORIGIN, so it gets the sandbox attribute and top-nav is blocked.

The matching is a strict, case-insensitive prefix match of the loaded URL against the url field in each url_permissions entry. Every character counts, including trailing slashes, schemes, and ports. The most common cause of a silent mismatch is a trailing-slash difference:

• Manifest entry: https://example.com/
• Runtime URL: https://example.com (no trailing slash) → does not match → no sandbox applied
• Runtime URL: https://example.com/foo?x=1 → matches → sandbox applied

Worth comparing side by side, for each environment:

1. The exact runtime value of the URL you're loading into the iframe (e.g. your LAUNCH_MODAL_APP_URL secret) — character for character, including trailing slash, query string, port, scheme.
2. The exact url_permissions[].url value in your CANVAS_MANIFEST.json.

I suspect once you line those up across dev and prod, you'll see prod has a small character-level difference (most likely a missing trailing slash) that's letting it skip the sandbox entirely. Once you correct that, prod will start behaving the same way dev does today — i.e. the navigation error will show up there too.

Options for fixing the navigation itself

Given the current sandbox doesn't allow top-frame navigation by design, you have a few options:

1. Use window.open(url, '_blank') instead of window.top.location = …. The current sandbox already includes allow-popups, so opening a new window/tab works inside the iframe.
2. Remove ALLOW_SAME_ORIGIN from the manifest entry for that URL if your app doesn't actually need same-origin access from inside the iframe. With ALLOW_SAME_ORIGIN removed, Canvas renders the iframe without a sandbox attribute, and top-frame navigation works.
3. Feature request: if you specifically need allow-top-navigation-by-user-activation while keeping ALLOW_SAME_ORIGIN, that would be a new permission on the SDK manifest (something like ALLOW_TOP_NAVIGATION). Another customer has asked for this before; it isn't on the roadmap yet but we can take feedback if this is important to you.

[oladimeji-akande]

Thanks for your help, @rmagier1. This issue is resolved.