{"action":"opened","issue":{"url":"https://api.github.com/repos/ikreymer/pywb/issues/137","labels_url":"https://api.github.com/repos/ikreymer/pywb/issues/137/labels{/name}","comments_url":"https://api.github.com/repos/ikreymer/pywb/issues/137/comments","events_url":"https://api.github.com/repos/ikreymer/pywb/issues/137/events","html_url":"https://github.com/ikreymer/pywb/issues/137","id":112221007,"number":137,"title":"SecurityError in wombat.js if outside frame is on different domain","user":{"login":"jcushman","id":376272,"avatar_url":"https://avatars.githubusercontent.com/u/376272?v=3","gravatar_id":"","url":"https://api.github.com/users/jcushman","html_url":"https://github.com/jcushman","followers_url":"https://api.github.com/users/jcushman/followers","following_url":"https://api.github.com/users/jcushman/following{/other_user}","gists_url":"https://api.github.com/users/jcushman/gists{/gist_id}","starred_url":"https://api.github.com/users/jcushman/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jcushman/subscriptions","organizations_url":"https://api.github.com/users/jcushman/orgs","repos_url":"https://api.github.com/users/jcushman/repos","events_url":"https://api.github.com/users/jcushman/events{/privacy}","received_events_url":"https://api.github.com/users/jcushman/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-10-19T19:59:53Z","updated_at":"2015-10-19T19:59:53Z","closed_at":null,"body":"[This line](https://github.com/ikreymer/pywb/blob/master/pywb/static/wombat.js#L2212) of wombat.js throws a SecurityError in Chrome when trying to access `real_parent.wbinfo`, if the outside frame is on a different domain (or otherwise sandboxed) from the replay iframe:\r\n\r\n    if (real_parent != $wbwindow && real_parent && real_parent.wbinfo && real_parent.wbinfo.is_frame) {\r\n\r\nThe SecurityError prevents wombat's url-rewriting stuff from loading.\r\n\r\nI *think* the best approach is just to wrap the whole `if{ }else{ }` block in a `try{ }catch{ }` to ignore the security error? But maybe there's a more precise version that still works cross-browser -- not sure.\r\n\r\n---\r\n\r\n(Note that in general it's a good idea to run replays from a different domain -- not just subdomain -- than your user accounts. We tried a few approaches to secure login cookies from malicious captures, before giving up and just switching replays to a different domain.)"}}