mirror of
https://github.com/angular/angular.git
synced 2026-09-14 13:54:52 +08:00
0152e3cbdf
Mark the iframe `credentialless` attribute as security-sensitive so dynamic bindings are handled consistently with other iframe attributes that affect the initial navigation, such as `sandbox`, `allow`, `referrerPolicy`, `csp`, and `fetchPriority`. Because `credentialless` must be present before the iframe starts loading to affect the navigation’s credential mode, late dynamic updates can leave the final DOM looking correct while the initial request was not loaded credentiallessly.