4 ms·
> Should we not decide that cross-origin window.opener is now deprecated, show big fat warnings on the developer console when it's used, and remove it in a year
by discreditable 9y ago
> Should we not decide that cross-origin window.opener is now deprecated, show big fat warnings on the developer console when it's used, and remove it in a year or two?
That does nothing for deployed sites that aren't actively developed? Browser devs have decided those sites are worth not breaking.
- metafunctor 9y agoBrowsers should show a warning that a "possibly insecure legacy mode" is in use. If browsers enforce HTTPS in a similar way, I don't see why they shouldn't enforce better security elsewhere as well.