[whatwg] Communicating between different-origin frames
James Graham
jgraham at opera.com
Wed Jul 14 02:39:42 PDT 2010
Following some discussion of [1], it was pointed out to me that it is
possible to make two pages on separate subdomains communicate without
either setting their document.domain by proxing the communication
through pages that have set their document.domain. There is a demo of
this at [2].
I'm not sure if this is already well-known nor whether it is harmless or
not.
[1]
http://my.opera.com/hallvors/blog/2010/07/13/ebay-versus-security-policy-consistency
[2] http://sloth.whyi.org/~jl/cross-domain.html
More information about the whatwg
mailing list