cooperq
commented
10 years ago This is a similar enough problem to #147 and #142 that I think they can all be solved the same way. Here is the solution as I see it:
User Story
Alice visits youtube.com and clicks on the text box below a video to comment. If the necesary domain (in this case apis.google.com) is not already allowed then Alice gets a popup telling her that she needs to allow this domain to take this action, but by doing that she could be letting the domain track her browsing. If Alice clicks 'OK' then the domain is put into Alices white list and Alice makes a comment on youtube. If Alice clicks 'Cancel' then the domain stays as it is and Alice continues on with her day. If Alice trys to comment on youtube again and it is still blocked, then she will once again get the popup.
Pseudo Code
OnBeforeRequest() do
if requestDomain in exceptionDomains
and request domain would be blocked or cookieblocked do
displayPopup('the action you are taking would need to allow this domain to track you. Do you want that to happen?')
if yes then move domain to user whitelist
if no then do nothing
done
done
/* This is a dictionary containing all of the domains that user may want to make an exception for. The key is the domain that will need to be allowed and the value is an array of the acceptable 1st party domains to show this popup on. If the array is empty then we show the popup for any request to the domain */
exceptionDomains = {
'login.disqus.com': [],
'apis.google.com': ['youtube.com'],
}
yawpitch
deanishe
ghostwords
NeoLegends
bkakadiya42
Sometimes when a user tries to use oAuth to log into a site with facebook or google or tries to use disqus to comment on a site or makes some other deliberate interaction with a third party resource it gets blocked. This presents a bad experience to the user who is prevented from using a website in the way they intended. We need to find a generalizable solution to this
Current Workarounds
facebook oauth and comments: unblock www.facebook.com unblock connect.facebook.com unblock static.ak.facebook.com unblock s-static.ak.facebook.com
you tube comments: unblock apis.google.com
disqus comments: unblock disqus.com
google oauth: unblock oauth.googleusercontent.com unblock apis.google.com