The original title is: "Safely hosting arbitrary user HTML: the cookieless-origin sandbox pattern"

Short summary

ShareMyPage demonstrates a production security pattern for safely hosting user-generated HTML—including LLM-generated content—using a separate, cookieless origin with strict iframe sandboxing. The architecture decouples access control (signed URLs) from execution isolation (origin policy), ensuring session data never reaches untrusted code even if sandboxing fails. Implementation uses a dedicated content domain without auth cookies, validates short-lived JWT tokens, and sandboxes iframes without allow-same-origin.

• •Serve untrusted HTML from a separate, cookieless origin to prevent session hijacking
• •Use signed URLs for access control separate from iframe sandbox for execution isolation
• •Never combine allow-scripts with allow-same-origin in iframe sandbox attributes

Generated with AI, which can make mistakes.