Quiz

Browser parsing and security boundaries

Explain source versus DOM, iframe origins, script isolation, and the boundary between browser checks and server trust.

Advanced2 min readLearn · Practice · Review

Published by HTML Code Runner · AI-assisted material · Independent editorial review pending · Editorial policy

On this page

What this check examines

These questions examine what the browser actually does with a document, rather than how a fragment happens to look. They connect parsing, navigation, and isolation to decisions you will encounter when embedding a widget or maintaining a learning playground. Read the stated conditions carefully: a security property can change when one permission is added.

Before answering, review the iframe and troubleshooting lessons. Predict which document owns an operation, which origin the browser assigns, and which part of the system is trusted to make a decision. Avoid answers that treat escaping, validation, and sandboxing as interchangeable. They address different boundaries.

After the quiz, draw a small diagram of a parent page and an embedded document. Mark where learner code executes and where the site reads account data. Explain why allowing scripts in a sandbox is different from allowing same-origin access. Then inspect an actual iframe element in developer tools and compare its permissions with your diagram. The score confirms your selected answers; the inspection exercise tests whether you can apply the ideas.

Reason through the choices

This is browser-side practice. Answers are available in the page source; scores are not a certification.

1. A page renders successfully. What can you conclude about its HTML conformance?


2. An iframe has sandbox="allow-scripts" and no allow-same-origin token. What is the intended origin boundary?


3. Which approach is appropriate for displaying learner code in the parent editor?


4. What does escaping an href attribute fail to establish by itself?


5. A cross-document message contains useful-looking results. What should the receiver verify?


6. Why does a learning playground block network requests?


Turn the result into practice

Revisit each explanation you missed. Write a small counterexample that demonstrates why the tempting answer fails, then compare the source, parsed tree, and behavior. You can revise your answers and check again; scores stay on this device when storage is available.

Review the related lesson · Inspect a document · Try a coding challenge