
allow-scripts permission, preventing JavaScript execution.
allow-scripts attribute:html
<iframe src="your-preference-center-url" sandbox="allow-scripts allow-same-origin"></iframe>
If the sandbox attribute is present but does not include allow-scripts, JavaScript will be blocked.
html
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval' https://your-allowed-scripts.com;