3 ms·
Can you load, let's say maps.google.com/somepage in a hidden iframe and use postmessage to send location data if it already has access? Or do browsers force top
by eknkc 4y ago
Can you load, let's say maps.google.com/somepage in a hidden iframe and use postmessage to send location data if it already has access? Or do browsers force top level navigation for such permissions?
- amenghra 4y agoThere were probably covert ways to obtain the same information but it's now easier for Google to grab the information using regular APIs. It also means if app X and app Y on their own subdomains were previously using location APIs without any tricks, you are now effectively opting into both apps. Bottom line: technically it doesn't matter but it probably makes a difference in practice.
- eknkc 4y agoYeah it makes a lot of sense to do it this way, however it does not feel that nefarious when there were plausable workarounds anyway.
- amenghra 4y agoBrowser could implement finer grain permissions (i.e. only permit the API use for a given top level path regexp) but I bet most users won't bother fine tuning their grants.