#iframe 4 articles

• An .html file in a document library cannot be iframed — SharePoint serves it as a downloadgotchas / listsSharePoint serves library HTML as an attachment, so the iframe loads empty; host it elsewhere and allow that host in HTML Field Security
• Previewing library files in your own app: every format behaves differentlygotchas / spfxPDF embeds directly, Office needs WOPI by {UniqueId}, HTML is served as an attachment and never renders from src; SVG and HTML must never be framed from your own origin (uploader script runs in the viewer session) and…
• The tenant's CSP is inherited by srcdoc frames — inline scripts in embedded HTML never rungotchas / spfxModern pages send script-src without 'unsafe-inline', and a document you build yourself (srcdoc, blob:, data:) inherits it, so every inline script in the embedded HTML is dropped; an external file from an allow-listed…
• Your Application Customizer runs again inside SharePoint dialog iframesgotchas / spfxA floating button rendered twice, the copy pinned to the dialog's corner; refuse nested browsing contexts before anything else (+ un-render path and why a body MutationObserver needs a definitive „no“)