Google Tag Manager integration security - noscript iframe sandboxing

user_3120967 0
Viewed 3327

Good day.

I have a website using Google Tag Manager successfully implemented following the official guidelines ( https://developers.google.com/tag-manager/quickstart ), including the fragment suggested in step 2 :

<!-- Google Tag Manager (noscript) -->
<noscript><iframe src="https://www.googletagmanager.com/ns.html?id=GTM-XXXX"
height="0" width="0" style="display:none;visibility:hidden"></iframe></noscript>
<!-- End Google Tag Manager (noscript) -->

Close to the end of the <body> element of the main template, as it should be.

Now, I've been suggested by a consulting agency to add a sandbox attribute to that iframe element to strengthen the overall website security, among a set of other recommandations.

Although I think I get the point of the iframe sandbox attribute values and their consequences, I'd like somebody to enlighten me about what the benefits of it are in the context of a fixed, trusted iframe source and in the context of the noscript element (where no script is technically to be executed), in terms of security in particular. Please also explain what values, if any, you think might be apropriate in this particular context.

Ref for the sandbox attribute values : https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe#attr-sandbox

I've searched for this, and found no reference for this particular problem showing up.

Thank you in advance.

google-tag-manager noscript sandbox iframe html
1 Answers

Security

Normal Clients

This has no security impact given noscript sections are not rendered when javascript is available. The security significance of an iframe, if it existed, is also limited as you will be adding an actual script from the same site which has in-page code that can and does add content to the page from your origin as well as adding other iframes depending on your container configuration.

HTML5+ Clients w/o JS

In theory, this prevents google (or possibly specialized changes to your container contents) from benefiting by imitating your site in the iframe or running JS. But the style hides it and the client is probably not allowing JS only in sub-iframes unless they have domain specific JS-blocking rules.

HTML4- Clients w/o JS

They don't understand this attribute.

Possible Behavior Impacts:

  1. The GTM Debugger may be thrown off by changes to the default snippets and not appear.
  2. Browser Extensions or site scanners that verify snippets might report an error or warning.
  3. Execution for noJS clients may be affected, but it is unclear what configurable tracking can occur and it would probably be handled server-side which is unaffected by sandbox.
  4. Poorly written tags or other JS could orient too specifically on the contents of the noscript snippet and fail.
user_12694660
Related