<iframe width="560" height="315" src="https://www.youtube.com/embed/owsfdh4gxyc" frameborder="0" allowfullscreen></iframe>
Enables a set of extra restrictions on any content hosted by the iframe. The value of the sandbox attribute can be either the empty string (all the restrictions are applied), or a space-separated list of tokens that remove each respective restriction.
Possible Values and Their Descriptions
allow-top-navigation
Allows the nested browsing context to navigate (load) content to the top-level browsing context.
allow-same-origin
Allows the content to be treated as being from its normal origin. Without this token, the content is forced into a unique origin, thus preventing it from accessing other content from the same origin. Also, without the allow-same-origin token, scripts are prevented from reading from or writing to the document.cookie IDL attribute, and blocks access to localStorage and openDatabase().
allow-forms
Allows form submission (i.e. the nested browsing context can submit forms).
allow-scripts -Allows script execution (but not popup windows).
allow-pointer-lock
Enables Pointer lock.
Pointer lock provides input methods based on the movement of the mouse over time, not just the absolute position of the mouse cursor. Pointer lock is useful for applications that require significant mouse input to control movements, rotate objects, and change entries. It is particularly essential for highly visual applications, such as those that use first-person perspective, as well as 3D views and modeling. By default, sandboxed iframes block Pointer lock. This attribute allows you to enable Pointer lock on sandboxed iframes.
allow-popups
Allows popup windows.