4 ms·
No, this is about alerts from cross origin content, like from an iframe that loads from a different origin than the parent page
by pgo 5y ago
No, this is about alerts from cross origin content, like from an iframe that loads from a different origin than the parent page
- ceronman 5y agoIt would still break sites like codepen.io that use iframes for this.
- gregoriol 5y agocodepen's iframes are their own, not cross-origin
- mcintyre1994 5y agoThey're on another domain they own, but they are on another domain (cdpn.io) and the cross-origin concern does apply. They do that because they have auth cookies on codepen.io and don't want them exposed to the iframe. See these tweets by their cofounder: https://twitter.com/chriscoyier/status/1422940724295786503?s=20 https://twitter.com/chriscoyier/status/1422940724295786503?s... and https://twitter.com/chriscoyier/status/1420033471376920578?s=20 https://twitter.com/chriscoyier/status/1420033471376920578?s...
- asddubs 5y agoif they were on the same domain you could load iframes with the parent site and do arbitrary CSRF
- vasachi 5y agoGoogle is planning to remove alerts entirely: https://twitter.com/Rich_Harris/status/1422930436850860033 https://twitter.com/Rich_Harris/status/1422930436850860033
- Semaphor 5y agoDirect source: > Major browser vendors are generally aligned about wanting to move the platform away from alert() and friends, even though it will unfortunately involve some breakage. - https://twitter.com/estark37/status/1422694855390629893 https://twitter.com/estark37/status/1422694855390629893 That at least doesn’t seem like any kind of near-future thing. I just hope there’ll be some replacement, we use confirm() to prevents users from losing changes that weren’t saved (just like many other sites including fastmail and google)