mirrors/electron
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
electron/docs/api/web-security.md
Cheng Zhao fdcad1066e docs: Fix typos.
2014-08-20 10:57:39 +08:00

2.4 KiB
Raw Blame History

Web Security

Because atom-shell has added node integration to normal web pages, there are some security adjustments that made atom-shell both more safe and more convenient.

Overriding X-Frame-Options header

May websites (including Google and Youtube) use the X-Frame-Options header to disable access to their websites in iframes. In atom-shell you can add a disable-x-frame-options string in the iframe's name to disable this:

<!-- Refused to display -->
<iframe name="google" src="https://google.com"></iframe>
<!-- Loads as expected -->
<iframe name="google-disable-x-frame-options" src="https://google.com"></iframe>

Frames are sandboxed by default

In normal browsers, iframes are not sandboxed by default, which means a remote page in iframe can easily access its parent's JavaScript context.

In atom-shell because the parent frame may have the power to access native resources, this could cause security problems. In order to fix it, iframes in atom-shell are sandboxed with all permissions except the allow-same-origin by default.

If you want to enable things like parent.window.process.exit() in iframes, you need to explicitly add allow-same-origin to the sandbox attribute, or just set sandbox to none:

<iframe sandbox="none" src="https://github.com"></iframe>

Node integration in frames

The node-integration option of BrowserWindow controls whether node integration is enabled in web page and its iframes.

By default the node-integration option is except-iframe, which means node integration is disabled in all iframes. You can also set it to all, with which node integration is available to the main page and all its iframes, or manual-enable-iframe, which is like except-iframe, but enables iframes whose name contains string enable-node-integration. And setting to disable would disable the node integration in both the main page and its iframes.

An example of enable node integration in iframe with node-integration set to manual-enable-iframe:

<!-- iframe with node integration enabled -->
<iframe name="gh-enable-node-integration" src="https://github.com"></iframe>

<!-- iframe with node integration disabled -->
<iframe src="http://jandan.net"></iframe>