HTML5 Sandbox - a bad idea

Re:HTML5 Sandbox - a bad idea by bluetooth on Saturday April 06, 2013 @02:07AM (#5502794)

Some of the new HTTP headers are just a mess. Did you know that X-Frame-Options' Allow-From option only allows you to whitelist one URL? Not a domain - a URL. The RFC actually expects you to communicate via another channel to determine whether or not a URL will be allowed to frame your page.

Luckily, this one is still a draft...

[ Parent | on HN ]

Re:HTML5 Sandbox - a bad idea by homakov on Saturday April 06, 2013 @02:18AM (#5502818)

yes lol. design pisses me off. Why didn't they put XFO into Content security policy yet!

[ Parent | on HN ]

Re:HTML5 Sandbox - a bad idea by Dylan16807 on Saturday April 06, 2013 @05:15PM (#5505089)

Well if you assume that referer is turned on...

[ Parent | on HN ]