compono / idibu-v3-api

4 stars 3 forks source link

Iframe fails to load depending on 3rd party cookie policy #6

Open KeithHenry opened 5 years ago

KeithHenry commented 5 years ago

When loading via the <iframe> I get the following error:

Uncaught DOMException: Failed to read the 'sessionStorage' property from 'Window': Access is denied for this document.

This is because the script is calling (expanded from minified):

var n = e.console || t, ...
    s = e.sessionStorage || !1, ...  
    p = e.history;

The problem is that e.sessionStorage throws an exception when accessed in an <iframe> where Chrome's block third party cookies setting is on or auto (auto is default). I think the ||!1 means the code expects that it might be undefined but doesn't happen in the case of the security exception.

We can change all the users' settings to include *.idibu.com as an allowed 3rd party, but that is hassle for IT and when machines are missed the page crashes and gets stuck in a "One Moment Please" loading dialog.

Ideally: it should be able to handle local storage being unavailable if it is intended to be loaded in an <iframe>. At the very least it should fail with an error message informing the user that their browser's security settings need to be reduced for it to work.