Ready
PROXY MODE
0 ms
Copy these origins to your CORS proxy settings
The exact origin detected for your current browser window session:
When rendering inside the Web Code Canvas preview environment:
Understanding Same-Origin Policy and Proxy Mechanics
Browsers isolate different origins. A script on site-a.com cannot access or execute code directly inside an iframe running on site-b.com unless both sites permit it.
The proxy fetches the raw HTML server-side, strips restrictive headers like X-Frame-Options and Content-Security-Policy, injects custom scriptlets, and renders the result safely in your sandbox frame.
Direct iFrame mode embeds the target URL natively. You can toggle sandbox flags to control execution permissions, though sites enforcing X-Frame-Options: DENY may require Proxy Mode.