search

humanmade / protected-embeds

A drop-in replacement for WordPress.com protected embeds
11 stars 4 forks source link

Use defined embeds domain to serve protected embeds from #4

Closed goldenapples closed 8 years ago

goldenapples commented 8 years ago

I assume this was the intention initially. Its important to serve these embeds from a different domain than the site login cookie is set on, so as to avoid leaking auth or other cookies to potentially untrusted embed providers. This updates the src of the iframe appropriately to keep cookies from being sent to it.

See #3

goldenapples commented 8 years ago

@joehoyle Care to review this for me? I think it fixes a problem we're having.

joehoyle commented 8 years ago

Doh! My bad, thanks for the patch.