Viewer: cleanup definitions of embedded and iframed. Enable web view handshake #3162
Conversation
|
/cc @ericfs |
| * method. | ||
| * @private @const {boolean} | ||
| */ | ||
| this.isEmbedded_ = this.isIframed_ || !!this.params_['origin']; |
There was a problem hiding this comment.
Using origin here seems a bit unintuitive. Maybe call a method like isNativeEmbedder?
There was a problem hiding this comment.
@cramforce Sorry, do you mean add a "isNativeEmbedder" parameter?
There was a problem hiding this comment.
No, I meant to add a method of that name that does whatever work it needs to do. I don't really see how it follows out of the origin being present.
There was a problem hiding this comment.
I'll just add a new parameter then. We discussed with @ericfs that it might be better anyway.
There was a problem hiding this comment.
Is there any type of trust implied? What is the consequence of being embedded?
There was a problem hiding this comment.
Added webview=1 param.
There was a problem hiding this comment.
Currently, the consequence of being embedded is a trusted mode. Not much constraints we can reliably apply given that web view allows arbitrary script injection. We're currently going through security review with this. I can add an experiment if you'd like. But, again, the protection from it will be minimal.
|
Thanks! |
|
LGTM |
Closes #3117.