<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-2022-jp">
<meta content="text/html; charset=utf-8">
</head>
<body>
<div dir="auto" style="direction:ltr; margin:0; padding:0; font-family:sans-serif; font-size:11pt; color:black">
Please submit the issue to the tracker. <br>
<br>
<br>
</div>
<div dir="auto" style="direction:ltr; margin:0; padding:0; font-family:sans-serif; font-size:11pt; color:black">
<div dir="auto" style="direction:ltr; margin:0; padding:0; font-family:sans-serif; font-size:11pt; color:black">
<a href="https://aka.ms/ghei36">Outlook for Android</a> $B$+$i<hF@(B</div>
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Openid-specs-ab <openid-specs-ab-bounces@lists.openid.net> on behalf of Filip Skokan via Openid-specs-ab <openid-specs-ab@lists.openid.net><br>
<b>Sent:</b> Thursday, February 22, 2018 5:08:26 PM<br>
<b>To:</b> openid-specs-ab@lists.openid.net Ab<br>
<b>Subject:</b> [Openid-specs-ab] Session Management OP Frame assertions</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div>Hello everyone,</div>
<div><br>
</div>
<div>from <a href="https://openid.net/specs/openid-connect-session-1_0.html#OPiframe">OpenID Connect Session Management 1.0 - draft 28 [4.2. OP iframe]</a> </div>
<div><br>
</div>
<div>> The OP iframe MUST enforce that the caller has the same origin as its parent frame. It MUST reject postMessage requests from any other source origin.</div>
<div><br>
</div>
<div>I understand the intetion here but would like to raise a few questions/issues.</div>
<div><br>
</div>
<div>1) cross-domain parent origin is not accessible, accessing `window.parent.location.origin` raises a DOMException and other means of reading the url are unreliable and inconsistent at best (accessing `document.referrer` and building the origin url out of
it).</div>
<div>2) the parent frame (tab) is not actually the origin of the message, this would be the RP frame which might very well sit on a different subdomain, resulting in another origin.</div>
<div><br>
</div>
<div>I can see the example in the specification is not handling this either. Do you have any suggestions, is there something that i am missing? Is this something to be tracked in bitbucket and remove from the draft?</div>
<br clear="all">
<div>
<div class="gmail-m_5297303404923888317gmail_signature">Best,<br>
<b>Filip Skokan</b></div>
</div>
</div>
</div>
</body>
</html>