News for hackers. Stuff that matters.

A comment on Show HN: AcrossTabs – Easy communication between cross-origin browser tabs.

Re:Show HN: AcrossTabs – Easy communication between cross-or... by tiplus on Wednesday April 05, 2017 @08:14AM (#14041478)
I was puzzled when I first saw cross tab communication in impress.js for their slide control tab (slid.es) and I am still wondering about the proper use case of this feature today. Isn't this a security nightmare?
[ Parent | on HN ]
Re:Show HN: AcrossTabs – Easy communication between cross-or... by tyingq on Wednesday April 05, 2017 @08:31AM (#14041581)
It maps back to window.postMessage. There's a security concerns section on Mozilla's docs: https://developer.mozilla.org/en-US/docs/Web/API/Window/post...

All boils down the sender using a specific target, and the receiver remembering to check the origin.

[ Parent | on HN ]
Re:Show HN: AcrossTabs – Easy communication between cross-or... by d--b on Wednesday April 05, 2017 @12:08PM (#14043125)
Doesn't most Oauth2 things work that way?

http://www.riskcompletefailure.com/2013/03/postmessage-oauth...

[ Parent | on HN ]