- From: Hallvord R M Steen <hallvors@gmail.com>
- Date: Tue, 20 Mar 2007 17:17:27 +0100
> >> 1) Either it is your responsibility to handle the nulling of the > >> property *or* > >> 2) It is the UA's. > > > > The UA can not do this. It would break legacy pages by resetting > > window.opener if content comes from a different server. > If this is a security point, which I take from the subject > "window.opener and security" it is, there is no problem with a UA > breaking an implementation that relied on insecurity. Breaking *any* website is a problem. Yes, security is important. But this is a problem with a clear and limited (ab)use case - mainly webmails - and we can add a feature giving those relatively few webmail sites some easy-to-use opt-in security. > I can't think of a single reason that when a user navigates to > another domain, you would want that domain to access your > window.opener, so the UA clearly could do this. If the primary domain is www.example.com and the other domain is help.example.com the UA clearly should allow them to communicate by request. Believe me, nulling window.opener if origin check fails will break MANY sites. And now I'm going to shut up. Really :) -- Hallvord R. M. Steen
Received on Tuesday, 20 March 2007 09:17:27 UTC