However, when these alerts are coming from a cross-origin iframe, the UI is even more confusing because Chrome tries to explain the dialog is not coming from the browser itself or the top level page. Chrome mitigates these spoofs by prefacing the message with “ says.”. This has led to spoofs (particularly with window.prompt) where sites pretend that a particular message is coming from Chrome (e.g.
The current UI for JS dialogs (in general, not just for the cross-origin subframe case) is confusing, because the message looks like the browser’s own UI. Removing support for cross origin iframes’ ability to trigger the UI will prevent this kind of spoofing, and unblock further UI simplifications. The current UX is confusing, and has previously led to spoofs where sites pretend the message comes from Chrome or a different website. ” when the iframe is the same origin as the top frame, and “An embedded page on this page says.” when the iframe is cross-origin.
A very weak reason for removing such an important feature! Community and developers should protest! Problemįeature: Remove alert(), confirm(), and prompt for cross origin iframesĬhrome allows iframes to trigger Javascript dialogs, it shows “ says. And justification is very poor - see "motivation" bellow. This is absurd and subjective decision of Google to remove alert(), confirm(), and prompt() for cross origin iframes.
0 kommentar(er)
