You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Due to this line in GameAPI.js:
VKAPI requests stop working since after app navigates (other page opened inside iframe) document.referer changes it's value and API requests get sent to origin of an app and not OpenVK instance (and OVK instance can't receive and subsequently reply to the request).
Proposed solutions:
Don't restrict origins and just use '*' to send message to the parent window. Perhaps we could also use window.top for that? It's unlikely that OVK will be open in non-top context either way. Not sure if that's secure tho, but idk seems secure enough although I wonder why'd they add that parameter for restricting origins if it's not safe enough with '*'.
Use stackinfo library (available in npm) to obtain origin from inside the script via stack tricks:
The text was updated successfully, but these errors were encountered:
Due to this line in GameAPI.js:
VKAPI requests stop working since after app navigates (other page opened inside iframe) document.referer changes it's value and API requests get sent to origin of an app and not OpenVK instance (and OVK instance can't receive and subsequently reply to the request).
Proposed solutions:
'*'
to send message to the parent window. Perhaps we could also usewindow.top
for that? It's unlikely that OVK will be open in non-top context either way. Not sure if that's secure tho, but idk seems secure enough although I wonder why'd they add that parameter for restricting origins if it's not safe enough with'*'
.The text was updated successfully, but these errors were encountered: