Using iframes with Chromium 110/120
2 min
in chromium version 110 and later, brightscript javascript objects docid\ urrxhu7l v9ea zhy0jv3 are only supported within iframes in brightsignos version 9 0 191 or greater this change impacts developers who have been embedding content in iframes that rely on these brightsign specific objects apps with iframe content control if your application embeds content within an iframe and you have control over the content inside that iframe, you’ll need to adjust your approach instead of using brightsign objects directly inside the iframe, you should send messages from the iframe to the parent window using the postmessage() method the parent window, which contains the brightsign objects, can then handle these messages and execute the necessary actions below is an example in which the iframe sends a message to the parent window using window\ parent postmessage() the parent window listens for messages using the message event listener, and upon receiving a message, it can interact with the brightsign objects to perform the desired actions iframe content child iframe \<! inside the iframe > \<script> // create a message to send to the parent window const message = { action 'examplecommand', data 'example data' }; // send the message to the parent window window\ parent postmessage(message, ' '); // the ' ' wildcard allows any origin use specific origin for security \</script> parent window parent window with brightsign objects brightscript \<! parent window containing brightsign objects > \<script> window\ addeventlistener('message', (event) => { // make sure to validate the origin of the message for security if (event origin !== 'https //your trusted origin com') { return; } const message = event data; if (message action === 'examplecommand') { // use the brightsign object to perform the necessary action // example brightsignobject somefunction(message data); console log('received message ', message); } }); \</script> apps displaying public urls if your app loads public urls within an iframe, avoid using brightsign objects within the iframe public content can be unpredictable and potentially insecure using brightsign objects in such scenarios could expose your app to vulnerabilities if the content is compromised or maliciously altered avoid embedding brightsign objects in these cases and instead use node style @brightsign objects docid\ o2uiynvkbsyd1qxcvhvcn whenever possible these objects align with modern javascript development practices, provide enhanced security, and let you maintain compatibility and security across different environments and chromium versions