Sandbox/iframe issues with Turnstile

[ddavisj]

Environment

- Node Version:     v22.18.0
- Nuxt Version:     4.1.3
- CLI Version:      3.28.0
- Nitro Version:    2.12.7
- Package Manager:  pnpm@9.6.0
- Builder:          -
- User Config:      security, vite, typescript, alias, turnstile..
- Runtime Modules:  nuxt-security@2.5.0, @nuxtjs/turnstile@1.1.0..

Nuxt Security Version

2.5.0

Default setup used?

No, the bug happens only when I set custom values for the security option

Security options

Not providing for security reasons, happy to msg privately

Reproduction

N/A

Description

My form was working with Turnstile before installing Nuxt Security.
I'm now getting console errors when I load the page:

1. Blocked script execution in 'about:blank' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.

2. Uncaught TurnstileError: [Cloudflare Turnstile] Error: 110200.

ChatGPT suggests this is occurring because Nuxt Security is adding sandbox="allow-same-origin allow-scripts allow-popups", and that it also needs "allow-forms" in here.

I also tried injecting custom attributes via Nuxt config:
contentSecurityPolicy: {
sandbox: ['allow-scripts', 'allow-same-origin', 'allow-forms']
}
.. but this didn't work.

Additional context

No response

Logs

Blocked script execution in 'about:blank' because the document's frame is sandboxed and the 'allow-scripts' permission is not set.

Uncaught TurnstileError: [Cloudflare Turnstile] Error: 110200.
    at v (api.js:1:10348)
    at M (api.js:1:37818)

[Baroshem]

Hey there,

Can you paste your full nuxt.config?

[ddavisj]

Thanks! Sorry but would prefer not to post it for privacy/security reasons. Can I msg/email it to you?

[Baroshem]

Sure,

You can find me in the Discord channel of Nuxt :)

[ddavisj]

Thanks @Baroshem, sent you a message via Discord, please let me know if you don't receive it

[vejja]

@ddavisj
FYI Nuxt Turnstile works with Nuxt Security on my end - with default options though.

[ddavisj]

@ddavisj FYI Nuxt Turnstile works with Nuxt Security on my end - with default options though.

Thanks. Still haven't heard back from Jakub. Are you using Nuxt 4 @vejja?

[Baroshem]

Hey @ddavisj

I looked at the Nuxt Security code and we have not set the sandbox header anywhere. Not even in the strict setup. I also looked at your config sent to me via DM and it looks ok.

Not sure what could be the issue here. Could you try disable certain headers to see which one is causing the issue? Maybe something related to CSP but the browser reports it incorrectly?