Security considerations

[robertlight]

Just a thought:

This package looks promising but I'd like to suggest that you create a client (iframe-resident) element to your package that handles a security relationship.

See: https://github.com/robertlight/worldmapXBlock/blob/master/doc/worldmap-xblock-arch.rst

(something I did back in 2014).... it assigned a unique-id to each slave client and allowed only messages from that child who new the unique-id.

[pbojinov]

That’s interesting, thank you for sharing. Normally I’d leave the security to be handled by the user through setting the targetOrigin in window.postMessage, but this is a nice guard rail.

…

On Jun 21, 2018, at 10:56 AM, Robert Light ***@***.***> wrote: Just a thought: This package looks promising but I'd like to suggest that you create a client (iframe-resident) element to your package that handles a security relationship. See: https://github.com/robertlight/worldmapXBlock/blob/master/doc/worldmap-xblock-arch.rst (something I did back in 2014).... it assigned a unique-id to each slave client and allowed only messages from that child who new the unique-id. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.