That isn't feasible for us or their IT departments. "These customers generally choose to host the product themselves, which means signing up for the origin would fall on each of them individually. "I'm an engineer for a large ERP company and work on a product where hundreds of large customers (hundreds of thousands of users) are no longer able to use the product due to the removal of cross origin dialogs," wrote another developer. With this change I am scrambling to implement an ugly workaround because chunks of our web app are now broken for our tens of thousands of users." "This change has created quite a difficulty for us because we use a paid third party service embedded via iframe in our web app and I pass a small amount of limited custom JavaScript to that third party app when I instantiate their tool (to trigger some actions and customize part of the tool to the user)," wrote one developer last week.". In the Chromium issue where the removal is being tracked, developers have been chiming in to express their dismay at the way this change has been forced upon the web community.
If you want an example of how user concerns do not drive software development, check out this Google-backed API.And it only took *checks calendar* three years iFrame clickjacking countermeasures appear in Chrome source code.Google reCAPTCHA service under the microscope: Questions raised over privacy promises, cookie use.Be careful what you inline: Defunct video-hosting domain used to inject smut flicks into news articles, more.Since then, applications like social dev environment Codepen and Microsoft's Azure Cosmos DB have encountered problems because they present users with alerts, notifications, and confirmation windows via cross-origin iframes.
The deprecation of window.alert, window.prompt, and nfirm from cross-origin iframes took effect with the release of Chrome. And eventually, Google plans to remove these prompt mechanisms completely (from same-origin contexts as well as cross-origin ones), again to prevent potential abuse. By doing so, Google has broken more than a few web apps.
0 kommentar(er)
