Home/ Questions/Q 6589849
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-25T17:13:36+00:00

Assuming I allow developers to open any URL (local or remote) in a hidden

  • 0

Assuming I allow developers to open any URL (local or remote) in a hidden web browser and the developers can only receive common events from the web browser such as: document complete, before navigate, navigate error etc..

Are there any security concerns I’m not aware of ?
I think the same-origin security policy covers my concerns, However, it’s always good to consult with other and hear out other’s concerns.

BTW
I need this mechanism in some cases to detect if a user is logged in by navigating to the login page and intercept page redirection to success URL (I Wouldn’t want to open a popup for 1 sec and then close it right away).

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You will encounter cross-domain restrictions. Other than that, the framed page can easily direct the user to another site, eg:

    <script>
if(top != self) top.location.href = this.location.href;
</script>

    Well, that’s just of an annoyance for you. But consider:

    <script>
if(top != self) top.location.href = "http://evilsite.com/getviruses/";
</script>
    • 0