Re: Defining secure-enough origins. from Boris Zbarsky on 2014-08-22 (public-webappsec@w3.org from August 2014)

From: Boris Zbarsky <bzbarsky@mit.edu>
Date: Fri, 22 Aug 2014 09:57:37 -0400
To: Mike West <mkwst@google.com>
CC: "public-webappsec@w3.org" <public-webappsec@w3.org>, Chris Palmer <palmer@google.com>, Ryan Sleevi <sleevi@google.com>, Anne van Kesteren <annevk@annevk.nl>
Message-ID: <53F74C51.7050108@mit.edu>

On 8/22/14, 9:55 AM, Mike West wrote:
> I'm less convinced that breaking 'about:blank' is a bug, though I'm sure
> it's widely used. Would it be that bad to force about:blank frames to
> ask for data from their parent via postMessage?

How is the about:blank case fundamentally different from the srcdoc case?

-Boris

Received on Friday, 22 August 2014 13:58:06 UTC