Opera --> Cross-frame scripting / frameset

Mone

Opera has a strict security behavior dealing with cross-frame scripting through a frameset.

Even if some browsers has "not-so-strict" rules, we can say that a way to make "cross-frame scripting" compatible with most browsers, is to follow mozilla's rules that IMO makes a lot of sense.

Those rules don't specify what to do when page A and page B access each other through page C (where page C is a simple frameset containing 2 frames: PAGE_A and PAGE_B).

If page A and page B (coming from the same server or from two different servers within the same domain) set theirs domain to a suffix of it (eg app.lightstreamer.com->lightstreamer.com), and try to access the other page via the frames array of theirs parent (eg parent.frames["PAGE_A"]) then the access is succesfull with most browsers but not with Opera.

To let Page A and Page B interact (within Opera) you should set the same domain also on Page C.

We can't consider this as an issue but as an effort on keeping the browser secure as possibile.

Here is a simple test case - to test click TEST on one or both frames, an alert saying "OK" is the sign that the cross-frame access has been succesfull:
Shows the exception.
Sets the domain on the frameset and then works.

Mone

Oooops...sorry I forgot to mention how this is related to Lightstreamer :p

If your Push-pages live inside a frameset, so that Page A is a Push-page that creates the engine with the createEngine method and Page B is another Push-page which wants to get data from the Engine created by Page A, and you have deployed your application in the canonical way (i.e. the web resources coming from a web server and the pushed data coming from Lightstreamer Server) then you should set the domain "by hand" on the frameset file or your app will not work with Opera browsers.

Example frameset:
[highlight=html]
<html>
<script>
document.domain = "lightstreamer.com";
</script>
<frameset rows="50%,*">
<frame name="PAGE_A" src="pageA.html">
<frame name="PAGE_B" src="pageB.html">
</frameset>
</html>

Page A's javascript snippet
[highlight=javascript]
var lsPage = new PushPage();
lsPage.context.setDomain("lightstreamer.com");
...
lsPage.createEngine("MyApplication","/LS/","SHARE_SESSION");

Page B's javascript snippet
[highlight=javascript]
var lsPage = new PushPage();
lsPage.context.setDomain("lightstreamer.com");
...
lsPage.seekEngine("MyApplication", self.parent.frames.PAGE_A);