3 ms·

> I doubt that many sites rely on this broken behavior. Any web based system where a pop up dialog is opened to allow the user to select something that is then

> I doubt that many sites rely on this broken behavior. Any web based system where a pop up dialog is opened to allow the user to select something that is then inserted into the original page?

epidemian 11y ago
Good call! I guess i haven't seen any of those. But i've seen some internal web based systems that relied too heavily on popup windows and started breaking when tabbed browsing became a thing and brosers started blocking popup windows by default, so i don't doubt that there are probably systems out there relying on this weird behavior of target=_blank. For those systems, though, i'd imagine most of them would have these popup windows on the same origin, right? So having browsers prevent child windows changing their parent's location if they are cross-origin seems like a sensible idea, or am i missing something else?
- panic 11y ago
  There are more than 1 billion websites. If just 0.1% of sites use target=_blank like that, you'd be breaking a million sites with your change. You can't use arguments like "I haven't seen any of those" or it "seems like a sensible idea" when making decisions like this.
  - epidemian 11y ago
    The "I haven't seen any of those" was just as a comment on why i couldn't think of possible uses for this target=_blank behavior, not a justification for the proposed change (what a lame justification that would be! :) That being said, i don't see how the proposal of browsers blocking popup windows from redirecting the parent window (if it's cross-origin) by default is any different from, for instance, them blocking popup windows from opening unless it was a user action that triggered them, which all browsers started doing by default quite some time ago. Could you elaborate on why this wouldn't be a sensible solution?
    - panic 11y ago
      It does seem like a sensible solution, but the web isn't exactly a sensible place. People use terribly-written web sites for all sorts of things that are important to them in their life. Changes that potentially break these sites shouldn't be taken lightly.
    - bzbarsky 11y ago
      Should the parent window be able to navigate the popup window, even if it's cross origin? If not, now you're suggesting some sort of asymmetric security checks that depend on something that's not just the origins. Security checks that, chances are, will be easy to evade by malicious actors. At least I haven't thought of a non-evadable one here yet.
  - adrianN 11y ago
    Lots of websites used to use Java applets, but browsers decided they're not worth the security risk and made users jump through more and more hoops to start embedded Java.
  - lazyjones 11y ago
    > you'd be breaking a million sites with your change. Websites relying on such obscure misbehavior are already broken in my book. Fixing them would solve the problem better and cause fewer new problems for everyone else.
    - panic 11y ago
      They aren't already broken for the people who rely on them.
      - lazyjones 11y ago
        It's a security risk, some sites relying on this will be affected by malicious content on sites they link to, so at the very least they'll now have to add one of the 2 limiting rel attributes on links that do not require the misbehavior to function. Thanks to the bright and sensible handful of people who add extra cruft to HTML after a brief exchange on a mailing list 3 years after a problem was reported, the other 99.9% of the websites will have to be modified too.
- PinguTS 11y ago
  For example Typo3 is using that, when you need to select something to be inserted/referenced into the current record. So any, Typo3 based website would break.
  - deleted 11y ago
    [deleted]
roywiggins 11y ago
Probably there are, but they're hardly likely to rely on it working cross-origin, and if they are they almost deserve to have it broken...
- reitanqild 11y ago
  Not sure but I would think anything that use a pop up to login using social media account would like to get an event back when successfully logged in?
  - sjwright 11y ago
    Social media networks are well placed to get their little embedded code snippets updated across the web. And chances are, these links are being generated by a cross-origin javascript library anyway. If you wanted to be very generous, browsers could auto-whitelist origins of every javascript library loaded in the page. In any remaining cases, there should still be some method to white-list the current behavior, e.g. rel=allowopener.

> I doubt that many sites rely on this broken behavior. Any web based system where a pop up dialog is opened to allow the user to select something that is then inserted into the original page?

epidemian 11y ago

Good call! I guess i haven't seen any of those. But i've seen some internal web based systems that relied too heavily on popup windows and started breaking when tabbed browsing became a thing and brosers started blocking popup windows by default, so i don't doubt that there are probably systems out there relying on this weird behavior of target=_blank. For those systems, though, i'd imagine most of them would have these popup windows on the same origin, right? So having browsers prevent child windows changing their parent's location if they are cross-origin seems like a sensible idea, or am i missing something else?

panic 11y ago
There are more than 1 billion websites. If just 0.1% of sites use target=_blank like that, you'd be breaking a million sites with your change. You can't use arguments like "I haven't seen any of those" or it "seems like a sensible idea" when making decisions like this.
- epidemian 11y ago
  The "I haven't seen any of those" was just as a comment on why i couldn't think of possible uses for this target=_blank behavior, not a justification for the proposed change (what a lame justification that would be! :) That being said, i don't see how the proposal of browsers blocking popup windows from redirecting the parent window (if it's cross-origin) by default is any different from, for instance, them blocking popup windows from opening unless it was a user action that triggered them, which all browsers started doing by default quite some time ago. Could you elaborate on why this wouldn't be a sensible solution?
  - panic 11y ago
    It does seem like a sensible solution, but the web isn't exactly a sensible place. People use terribly-written web sites for all sorts of things that are important to them in their life. Changes that potentially break these sites shouldn't be taken lightly.
  - bzbarsky 11y ago
    Should the parent window be able to navigate the popup window, even if it's cross origin? If not, now you're suggesting some sort of asymmetric security checks that depend on something that's not just the origins. Security checks that, chances are, will be easy to evade by malicious actors. At least I haven't thought of a non-evadable one here yet.
- adrianN 11y ago
  Lots of websites used to use Java applets, but browsers decided they're not worth the security risk and made users jump through more and more hoops to start embedded Java.
- lazyjones 11y ago
  > you'd be breaking a million sites with your change. Websites relying on such obscure misbehavior are already broken in my book. Fixing them would solve the problem better and cause fewer new problems for everyone else.
  - panic 11y ago
    They aren't already broken for the people who rely on them.
    - lazyjones 11y ago
      It's a security risk, some sites relying on this will be affected by malicious content on sites they link to, so at the very least they'll now have to add one of the 2 limiting rel attributes on links that do not require the misbehavior to function. Thanks to the bright and sensible handful of people who add extra cruft to HTML after a brief exchange on a mailing list 3 years after a problem was reported, the other 99.9% of the websites will have to be modified too.
PinguTS 11y ago
For example Typo3 is using that, when you need to select something to be inserted/referenced into the current record. So any, Typo3 based website would break.
- deleted 11y ago
  [deleted]

roywiggins 11y ago

Probably there are, but they're hardly likely to rely on it working cross-origin, and if they are they almost deserve to have it broken...

reitanqild 11y ago
Not sure but I would think anything that use a pop up to login using social media account would like to get an event back when successfully logged in?
- sjwright 11y ago
  Social media networks are well placed to get their little embedded code snippets updated across the web. And chances are, these links are being generated by a cross-origin javascript library anyway. If you wanted to be very generous, browsers could auto-whitelist origins of every javascript library loaded in the page. In any remaining cases, there should still be some method to white-list the current behavior, e.g. rel=allowopener.