Re: Defining secure-enough origins.

On Fri, Aug 22, 2014 at 3:57 PM, Boris Zbarsky <bzbarsky@mit.edu> wrote:

> On 8/22/14, 9:55 AM, Mike West wrote:
>
>> I'm less convinced that breaking 'about:blank' is a bug, though I'm sure
>> it's widely used. Would it be that bad to force about:blank frames to
>> ask for data from their parent via postMessage?
>>
>
> How is the about:blank case fundamentally different from the srcdoc case?


Frames can be navigated to 'about:blank' across origins (via window.opener,
for instance). Frames can't be navigated to an effective 'about:srcdoc' (I
think).

-mike