Show HN: AcrossTabs – Easy communication between cross-origin browser tabs

Re:Show HN: AcrossTabs – Easy communication between cross-or... by mnarayan01 on Wednesday April 05, 2017 @08:22AM (#14041528)

Looks like a nice library, though using a default of `*` for Origin seems like an invitation for people to shoot themselves in the foot.

[ Parent | on HN ]

Re:Show HN: AcrossTabs – Easy communication between cross-or... by softvar on Wednesday April 05, 2017 @08:29AM (#14041569)

Yea, that's totally true. I would recommend using an origin property to be used every time an instance of the Library is created. Please refer: https://github.com/wingify/across-tabs#usage

[ Parent | on HN ]

Re:Show HN: AcrossTabs – Easy communication between cross-or... by detaro on Wednesday April 05, 2017 @08:34AM (#14041597)

Then don't have a default that works without doing so. Really, defaults like this lead to "works, ship it" and totally unnecessary cases of vulnerable software.

[ Parent | on HN ]

Re:Show HN: AcrossTabs – Easy communication between cross-or... by Karupan on Wednesday April 05, 2017 @07:31PM (#14046649)

Second this. A lot of developers will just drop it in without reading the caveats. Just make the origin a mandatory parameter.

[ Parent | on HN ]

Re:Show HN: AcrossTabs – Easy communication between cross-or... by softvar on Wednesday April 05, 2017 @11:07AM (#14042615)

Does that mean, the library should not act when an origin is not specified and throw some kinda message in the console?

[ Parent | on HN ]

Re:Show HN: AcrossTabs – Easy communication between cross-or... by tokenizerrr on Wednesday April 05, 2017 @04:06PM (#14045119)

Yes, a required argument. It's not uncommon. Think API keys.

[ Parent | on HN ]

Re:Show HN: AcrossTabs – Easy communication between cross-or... by fdim on Wednesday April 05, 2017 @11:15AM (#14042687)

Reminds me mongodb being open/unprotected by default, that turned out well...

[ Parent | on HN ]

Re:Show HN: AcrossTabs – Easy communication between cross-or... by deadbunny on Wednesday April 05, 2017 @10:25AM (#14042277)

Don't use unsafe defaults ffs, that's how things get exploited.

[ Parent | on HN ]

Re:Show HN: AcrossTabs – Easy communication between cross-or... by softvar on Wednesday April 05, 2017 @11:07AM (#14042608)

Does that mean, the library should not act when an origin is not specified and throw some kinda message in the console?

How can it be enforced? Any suggestions?

Users can also make it a bit more complicated while using `*` to get hacked by accepting responses which match some kinda pattern(it's not bullet-proof though) and simply discarding others.

[ Parent | on HN ]

Re:Show HN: AcrossTabs – Easy communication between cross-or... by cryptarch on Wednesday April 05, 2017 @12:39PM (#14043384)

Put the wildcard functionality behind a setter with a long name and make the default the current domain?

[ Parent | on HN ]

Re:Show HN: AcrossTabs – Easy communication between cross-or... by Bartkusa on Wednesday April 05, 2017 @02:28PM (#14044375)

Put it behind a setter with "doNotUseOrYouWillBeFired" in the function name.

https://github.com/facebook/react/blob/80bff5397bf854750dbe7...

[ Parent | on HN ]