Skip to content

Conversation

@deansheather
Copy link
Member

This event isn't sensitive, so it should be sent to all parent origins. Some situations may require running an iframe to code-server on a separate domain to the code-server instance, and they might want to listen to this event.

window.location.origin limited this event to only the same domain.

This does not change the iframe behavior in any other way. Iframes are still allowed by default unless explicitly blocked via response headers or another mechanism.

@deansheather deansheather changed the base branch from v3.8.0 to master January 26, 2021 19:02
@deansheather deansheather force-pushed the send-ready-to-all-origins branch from 24ce7f3 to 42dcfc9 Compare January 26, 2021 19:06
@deansheather deansheather merged commit 1fcb0c3 into master Jan 26, 2021
@deansheather deansheather deleted the send-ready-to-all-origins branch January 26, 2021 19:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants