# Sandboxed iframe allowlist missing option

**URL:** <https://community.developer.atlassian.com/t/sandboxed-iframe-allowlist-missing-option/62698>\
**Category:** Forge UI Kit and Custom UI\
**Created:** [October 19, 2022, 9:56am UTC](https://community.developer.atlassian.com/t/sandboxed-iframe-allowlist-missing-option/62698 "2022-10-19T09:56:29Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![magnus](https://avatars.discourse-cdn.com/v4/letter/m/e9c0ed/32.png) [@magnus](https://community.developer.atlassian.com/u/magnus)\
**Post date:** [October 19, 2022, 9:56am UTC](https://community.developer.atlassian.com/t/sandboxed-iframe-allowlist-missing-option/62698/1 "2022-10-19T09:56:29Z")

</div>

According to the documentation ([Change notice: Sandboxing of Connect App iframes](https://developer.atlassian.com/cloud/bitbucket/connect-app-iframe-sandbox/)), the sandboxed iframe should include “allow-top-navigation-by-user-activation” in the allow list.  
I have created a Custom UI macro for Confluence, but the generated sandboxed iframe does not include the “allow-top-navigation-by-user-activation” option. The list includes only these:

“allow-downloads allow-forms allow-modals allow-pointer-lock allow-same-origin allow-scripts”

Is there a way to configure this?

Thanks!

---

<div class="post-metadata">

**Author:** ![AlvaroBezerra](https://sea1.discourse-cdn.com/atlassiandeveloper/user_avatar/community.developer.atlassian.com/alvarobezerra/32/41104_2.png) [@AlvaroBezerra](https://community.developer.atlassian.com/u/AlvaroBezerra)\
**Post date:** [October 19, 2022, 9:01pm UTC](https://community.developer.atlassian.com/t/sandboxed-iframe-allowlist-missing-option/62698/2 "2022-10-19T21:01:37Z")

</div>

Hi @magnus,

The documentation you have linked only applies to Connect-based apps. As you are using Custom UI with Forge, the list of sandbox restrictions is different, see: [https://developer.atlassian.com/platform/forge/custom-ui/iframe/#sandbox-restrictions](https://developer.atlassian.com/platform/forge/custom-ui/iframe/#sandbox-restrictions)

At the moment, it’s not possible to configure those.

However, If your intent is only to navigate the host window, you should be able to achieve that with Custom UI `router` API.

See the docs for reference: [https://developer.atlassian.com/platform/forge/custom-ui-bridge/router/](https://developer.atlassian.com/platform/forge/custom-ui-bridge/router/)