title: How to make allow-scripts and allow-same-origin coexist in iframe?
body: <p>So i just want to sandbox one html file in iframe and it works as long as there is just <code>allow-scripts</code> attribute, but as soon as I add <code>allow-same-origin</code> it stops to work because of this:</p>
  
  <blockquote>
    <p>Notes about sandboxing:
    When the embedded document has the same origin as the embedding page, it is strongly discouraged to use both <strong>allow-scripts</strong> and <strong>allow-same-origin</strong>, <strong>as that lets the embedded document remove the sandbox attribute</strong> — making it no more secure than not using the sandbox attribute at all.
    Sandboxing is useless if the attacker can display content outside a sandboxed iframe — such as if the viewer opens the frame in a new tab. Such content should be also served from a separate origin to limit potential damage.
    The sandbox attribute is unsupported in Internet Explorer 9 and earlier.From:<br>
    <a href="https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe" rel="nofollow noreferrer">https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe</a></p>
  </blockquote>
  
  <p>Code of iframe:</p>
  
  <pre><code>&lt;iframe src="index.html" sandbox='allow-scripts allow-same-origin'&gt;&lt;/frame&gt;
  </code></pre>
  
  <p>I want <code>allow-same-origin</code> because I want to use same css in iframe as is in index.html.</p>