mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

📝 allowpopups

Browse source
This commit is contained in:
Felix Rieseberg 2018-01-29 11:04:02 -08:00
parent cdb20d2692
commit 4cb22dd2ff
1 changed files with 25 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
docs/tutorial/security.md
View file

@ -395,6 +395,31 @@ const mainWindow = new BrowserWindow()
```
## Do Not Use `allowpopups`
If you are using `WebViews`, you might need the pages and scripts loaded in
your `<webview>` tag to open new windows. The `allowpopups` attribute enables
them to create new `BrowserWindows` using the `window.open()` method. By
default, `WebViews` are not allowed to create new windows.
### Why?
If you do not need popups, you are better off not allowing the creation of
new `BrowserWindows` by default. This follows the principle of the minimally
required access: Websites that you do not know to need popups should not have
the ability to create new popups.
### How?
```html
<!-- Bad -->
<webview allowpopups src="page.html"></webview>
<!-- Good -->
<webview src="page.html"></webview>
```
## Verify WebView Options Before Creation
A WebView created in a renderer process that does not have Node.js integration
enabled will not be able to enable integration itself. However, a WebView will