Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Detail redirect/navigation handling #5

Merged
merged 2 commits into from
Jul 2, 2024
Merged

Detail redirect/navigation handling #5

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d4f948f
Detail redirect/navigation handling
arichiv Jul 2, 2024
6ca3989
Update README.md
arichiv Jul 2, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,6 +104,8 @@ Within the popin context, `window.open` cannot be used to open a nested popin.
This API is only available in secure contexts and can only open secure contexts.
Attempting to navigate/redirect a popin to an insecure context will fail.

The popin can navigate/redirect, but will always be partitioned as though it was embeded as an iframe in the opener.

User interaction is required to open the popin.
Without user interaction the popin will be blocked and an error will be thrown when calling `window.open`.
This is important to prevent short-lived popins from being opened and immediately grabbing auto-fill information to nearly-silently complete login without user consent.
Expand Down Expand Up @@ -174,7 +176,7 @@ Popin-Policy: partitioned=("https://demo.example/")

`partitioned=("https://demo.example/")` allows the page to be loaded in a partitioned popin context by a top-level frame on https://demo.example/ specifically.

Navigating to or redirecting through a page without a `Popin-Policy` that permits the opening context to do so will cause the popin to automatically close the popin and report the error to the opening context.
Navigating to or redirecting through a page without a `Popin-Policy` that permits the opening context to do so will cause the popin to automatically close and report the error to the opening context.

This header is important to ensure that, where partitioned popins are used for authentication and other sensitive tasks, the pages engaging in these sensitive tasks affirmatively consent to the popin context. This prevents unexpectedly authenticated iframe contexts from breaking assumptions sites have made about their security model.

Expand Down