21–27 of 27 posts
I was puzzled when I first saw cross tab communication in impress.js for their slide control tab (slid.es) and I am still wondering about the proper use case of this feature today. Isn't this a security nightmare?
http://www.riskcompletefailure.com/2013/03/postmessage-oauth...
Earlier quoted context omitted.
Don't use unsafe defaults ffs, that's how things get exploited.
Does that mean, the library should not act when an origin is not specified and throw some kinda message in the console? How can it be enforced? Any suggestions? Users can also make it a bit more complicated while using `*` to get hacked by accepting responses which match some kinda pattern(it's not bullet-proof though) and simply discarding others.
Chrome and Firefox support BroadcastChannel https://developers.google.com/web/updates/2016/09/broadcastc... https://developer.mozilla.org/en-US/docs/Web/API/BroadcastCh...
Earlier quoted context omitted.
Does that mean, the library should not act when an origin is not specified and throw some kinda message in the console? How can it be enforced? Any suggestions? Users can also make it a bit more complicated while using `*` to get hacked by accepting responses which match some kinda pattern(it's not bullet-proof though) and simply discarding others.
Put the wildcard functionality behind a setter with a long name and make the default the current domain?
https://github.com/facebook/react/blob/80bff5397bf854750dbe7...
Earlier quoted context omitted.
Then don't have a default that works without doing so. Really, defaults like this lead to "works, ship it" and totally unnecessary cases of vulnerable software.
Does that mean, the library should not act when an origin is not specified and throw some kinda message in the console?
I think I understand what this does, but I don't think I understand the use case. Does anyone have any real-world examples of where this helps?
We had this exact problem before, we had a single-page-app console for sales agents and they would open up a lot of tabs, one for each conversation. If we didn't sync between the tabs, a lot of alerts and whatnot would have been duplicated.
Earlier quoted context omitted.
Yea, that's totally true. I would recommend using an origin property to be used every time an instance of the Library is created. Please refer: https://github.com/wingify/across-tabs#usage
Then don't have a default that works without doing so. Really, defaults like this lead to "works, ship it" and totally unnecessary cases of vulnerable software.