4 ms·

question, how did you grab the session and display tasks without authenticating through OAuth or whatever method google provides? Granted I'm logged into gmail

question, how did you grab the session and display tasks without authenticating through OAuth or whatever method google provides? Granted I'm logged into gmail but I'm somewhat goosed since it seems your third party domain can pull private data from my account without my explicit permission?

cmikec 16y ago
Good question. It's actually just an illusion. My page simply instructs your computer to connect to Google's servers, and then "wraps" the responses from Google at the page level into frames. I literally cannot see anything at all that you send to Google or receive from Google. In fact, this entire app is 100% client-side, so it never communicates with my server except to download the initial code (ok, fine, and favicon). There was an old trick years ago where mischievous webmasters would "wrap" a file:// URL in their web page to make it look like their page had access to all the files on your computer. Again, it's just a wrapper. No data is transmitted to or from the server about what's in the wrapper.
Groxx 16y ago
It's a handful of iframes going here: https://mail.google.com/tasks/ig https://mail.google.com/tasks/ig , nothing more. I'll stick to https://mail.google.com/tasks/canvas https://mail.google.com/tasks/canvas though this is quite nice. I wish it could remember the lists I had visible, but I realize why it can't :) To the maker: nice idea! It makes me ponder over what other sites this could be done to... though this is a particularly perfect fit!
- cmikec 16y ago
  Thanks. And yeah, I really wish it could remember the lists. I'm hoping that someone will know an undocumented parameter we can pass to http://mail.google.com/tasks/ig http://mail.google.com/tasks/ig to select a list. Anyone?
  - StavrosK 16y ago
    I snooped around a bit and it seems that you can do it by POSTing a JSON parameter to that URL, although I'm not sure if it includes a nonce.
  - cmikec 16y ago
    I just figured it out! Now, in Chrome and FF4 it remembers the lists you select. I'm really excited about this...enjoy! :)
    - Groxx 16y ago
      Very nice, that makes it a lot more useful :) I may even switch from Canvas view. Hopefully others see this! Mind if I ask how? I see the URLs are list-specific now, but I don't know how you set it up to be so.
- mrchess 16y ago
  Hey Groxx how did you find about the /canvas link? I could find no reference on Google that would have direct me to it in the first place! Very curious how you knew about it. Thanks for it btw as I never knew it existed.
  - fatjonny 16y ago
    http://www.google.com/support/websearch/bin/answer.py?answer=139249 http://www.google.com/support/websearch/bin/answer.py?answer... It is a part of tasks for iGoogle.
  - Groxx 16y ago
    I found out about it via the Better Google Tasks Chrome extension. Probably never would've seen it otherwise.

cmikec 16y ago

Good question. It's actually just an illusion. My page simply instructs your computer to connect to Google's servers, and then "wraps" the responses from Google at the page level into frames. I literally cannot see anything at all that you send to Google or receive from Google. In fact, this entire app is 100% client-side, so it never communicates with my server except to download the initial code (ok, fine, and favicon). There was an old trick years ago where mischievous webmasters would "wrap" a file:// URL in their web page to make it look like their page had access to all the files on your computer. Again, it's just a wrapper. No data is transmitted to or from the server about what's in the wrapper.

Groxx 16y ago

It's a handful of iframes going here: https://mail.google.com/tasks/ig https://mail.google.com/tasks/ig , nothing more. I'll stick to https://mail.google.com/tasks/canvas https://mail.google.com/tasks/canvas though this is quite nice. I wish it could remember the lists I had visible, but I realize why it can't :) To the maker: nice idea! It makes me ponder over what other sites this could be done to... though this is a particularly perfect fit!

cmikec 16y ago
Thanks. And yeah, I really wish it could remember the lists. I'm hoping that someone will know an undocumented parameter we can pass to http://mail.google.com/tasks/ig http://mail.google.com/tasks/ig to select a list. Anyone?
- StavrosK 16y ago
  I snooped around a bit and it seems that you can do it by POSTing a JSON parameter to that URL, although I'm not sure if it includes a nonce.
- cmikec 16y ago
  I just figured it out! Now, in Chrome and FF4 it remembers the lists you select. I'm really excited about this...enjoy! :)
  - Groxx 16y ago
    Very nice, that makes it a lot more useful :) I may even switch from Canvas view. Hopefully others see this! Mind if I ask how? I see the URLs are list-specific now, but I don't know how you set it up to be so.
mrchess 16y ago
Hey Groxx how did you find about the /canvas link? I could find no reference on Google that would have direct me to it in the first place! Very curious how you knew about it. Thanks for it btw as I never knew it existed.
- fatjonny 16y ago
  http://www.google.com/support/websearch/bin/answer.py?answer=139249 http://www.google.com/support/websearch/bin/answer.py?answer... It is a part of tasks for iGoogle.
- Groxx 16y ago
  I found out about it via the Better Google Tasks Chrome extension. Probably never would've seen it otherwise.