News for hackers. Stuff that matters.

A comment on Payment iframe - the easiest way to insert Stripe into your website. Parent comment

Re:Payment iframe - the easiest way to insert Stripe into yo... by bentlegen on Monday August 13, 2012 @02:57PM (#4377466)
@cperciva – wrong. Both pages have to opt into the same domain for that to work.

As in, even if the "evil script" set it's domain to yourdomain.com, unless your pages on yourdomain.com ALSO do

document.domain = 'yourdomain.com';

The script on the subdomain can't access that content.

[EDIT] Whoever is downvoting this, can you demonstrate otherwise?

[ Parent | on HN ]
Re:Payment iframe - the easiest way to insert Stripe into yo... by cperciva on Monday August 13, 2012 @03:03PM (#4377496)
My understanding is that pages from yourdomain.com would already have document.domain set to 'yourdomain.com', but I'm not a javascript expert.
[ Parent | on HN ]
Re:Payment iframe - the easiest way to insert Stripe into yo... by bentlegen on Monday August 13, 2012 @03:07PM (#4377521)
@cperciva – it is and it isn't. Implicit vs explicit. This answer expands:

http://stackoverflow.com/a/3978372

[ Parent | on HN ]
Re:Payment iframe - the easiest way to insert Stripe into yo... by cperciva on Monday August 13, 2012 @03:27PM (#4377644)
This reminds me of the WAT talk.

It's also crazy enough that I wouldn't want to trust that every browser in the world will always share that same behaviour.

[ Parent | on HN ]
Re:Payment iframe - the easiest way to insert Stripe into yo... by bentlegen on Monday August 13, 2012 @04:33PM (#4377997)
This document.domain behaviour is documented as part of the HTML spec:

http://www.whatwg.org/specs/web-apps/current-work/multipage/...

[ Parent | on HN ]