3 ms·

I've written code several times that relies on user agent parsing to know whether it needs to work around a bug: * Chrome on iOS started sending "webp" on it's

by jefftk 7y ago

I've written code several times that relies on user agent parsing to know whether it needs to work around a bug: * Chrome on iOS started sending "webp" on it's Accept header when it didn't support inline webp yet. * Firefox would take CSPs applied to same-origin IFrames and additionally apply them to the parent document. * Edge wouldn't accept data URLs for IFrames that were more than 4096 characters. In all of these cases the bug was eventually fixed, but we needed to work around the bug in the meantime. UA parsing to say "if it's Edge < v76" or whatever was the best way to do this.

heavenlyblue 7y ago
Why the hell do you need data URLs for iframes?
- jefftk 7y ago
  If you want to render untrusted content, cross-origin IFrames are a great way to do it. A data: url gives you an cross origin context without a network round trip and with fewer issues than using the sandbox attribute.