Re: ACTION-314: Draft non-normative examples of how a multi-domain site technically can ask for exceptions

Shane,

 

I don't think that will work, because the document origin of the iframes
will be different to the top level document origin of the page. i.e. if an
iframe embedded in site xyz.com has src=companyxyz.com/resource then JS in
the resource (executed in a third-party context) will not be able to set an
exception for xyz.com. This is as it should be because otherwise it would be
too easy for third-party script to silently create exceptions without the
user being aware 

 

Script in the window (with doc origin ) companyxyz.com could set up a target
exception for xyz.com and vice versa though.

 

 

Mike