diff --git a/docs/guides/publishing/embedding.md b/docs/guides/publishing/embedding.md index 3c25b077498..50888b09e26 100644 --- a/docs/guides/publishing/embedding.md +++ b/docs/guides/publishing/embedding.md @@ -1,8 +1,8 @@ # Embedding -There are various ways to embed marimo notebooks in other web pages, such +There are various ways to embed marimo notebooks in other web pages, such as web documentation, educational platforms, or static sites in general. Here -are two ways: +are the main approaches: * Host on [GitHub Pages](github_pages.md) or [self-host WASM HTML](self_host_wasm.md), and ` +``` + +* **`allow-scripts`**: Required for JavaScript execution (essential for marimo to run) + +!!! note "Basic Functionality" + With only `allow-scripts`, marimo will work but with limitations: WebSocket connections will function, but storage will be in-memory only (state resets on page reload), and clipboard access will use browser prompts instead of the clipboard API. + +### Recommended Sandbox Attributes + +For the best user experience, include these additional attributes: + +```html + +``` + +**Additional Attributes:** + +* **`allow-same-origin`**: Enables persistent storage (localStorage) and full clipboard API. Only use this if you trust the content of the iframe or the iframe URL is hosted on a different domain. +* **`allow-downloads`**: Enables downloading notebook outputs, data exports, and screenshots +* **`allow-popups`**: Allows opening links and notebooks in new tabs +* **`allowfullscreen`** (attribute, not sandbox): Enables fullscreen mode for slides and outputs + +**Permission Policy:** + +* **`allow="microphone"`**: Required for `mo.ui.microphone()` widget functionality + +!!! tip "Security Considerations" + Only use `allow-same-origin` with trusted content or the iframe URL is hosted on a different domain. Combining `allow-scripts` and `allow-same-origin` allows the iframe to remove the sandbox attribute entirely, making the iframe as powerful as if it weren't sandboxed at all. + +### Example: Full Configuration + +Here's a complete example with all recommended settings: + +```html + +``` diff --git a/docs/guides/publishing/playground.md b/docs/guides/publishing/playground.md index 6b11228fe3f..24a2d4768e8 100644 --- a/docs/guides/publishing/playground.md +++ b/docs/guides/publishing/playground.md @@ -191,6 +191,7 @@ providing your users with an interactive code playground. width="100%" height="500" frameborder="0" + sandbox="allow-scripts" > ``` @@ -201,7 +202,6 @@ providing your users with an interactive code playground. To show editor controls (such as panels icons and the run button), use the query parameter `show-chrome=true` - ### Embedding an existing notebook To embed existing marimo notebooks into a webpage, first, [obtain a @@ -213,6 +213,7 @@ URL to your notebook](#creating-and-sharing-playground-notebooks), then put it i width="100%" height="500" frameborder="0" + sandbox="allow-scripts" > ``` @@ -229,6 +230,7 @@ You can optionally render embedded notebooks in read-only mode by appending width="100%" height="500" frameborder="0" + sandbox="allow-scripts" > ``` @@ -269,7 +271,7 @@ For example, if you are using MDX, you can use the following snippet: ```jsx const MdxNotebook = (props: { code: string }) => { return ( -