[Ax238]

New CapitalOne website violates cross-domain security protocols and throws a silent error in Opera:
CapitalOne snubs Opera with latest website revision - Open the Web & Take Action - Opera Community

There's a custom fix in the link as well. Why oh why, with all of their intelligent (hopefully) security professionals can they not figure out all that's needed is one line of javascript? Or better yet, to not break security protocols to begin with!

Ax

[Advertisements]

I think thats a lot like asking why all software vendors don't write software for a MAC. Why write code for 4 people?

[ScHwErV]

I think thats a lot like asking why all software vendors don't write software for a MAC. Why write code for 4 people?

[Tal]

I think thats a lot like asking why all software vendors don't write software for a MAC. Why write code for 4 people?

Opera does not have 4 users. Opera is a very popular browser, even if we're talking about 5% (I looked for statistics but I couldn't find them). Everyone is free to choose their browser... I use FF because I'm used to, but Opera is really better.

Also, it's not about writing code, it's about writing it correctly. Opera supports standards, unlike IE...

[ScHwErV]

Also, it's not about writing code, it's about writing it correctly. Opera supports standards, unlike IE...

Thats funny, since the site displays fine in every browser except Opera. Which standard is that?

[dsenette]

OH SNAP! hehe

my parent company has dissallowed Vista to be installed because it comes automatically with IE7....why is that a big deal? because the nutjobs don't want to fix their site to be cert compliant....IE7 flags the autogenerated Certs on the page and gives you the "do you want to continue" message since they apparently can't read enough to know that that means "press the button that says continue dummy" they say that vista (and subsequently IE7) "breaks" their site....duh goobers fix your cert (or better yet...register for a REAL one instead of an autogenerated one)...

[Ax238]

The sites do display fine in the other browsers because they allow a potentially dangerous situation to go unmonitored. Opera, for security sake, does not allow an iframe from a different domain than the parent page to change the location of the parent page. This is not about it displaying correctly, it's about it following proper cross-domain protocols. I'm curious why IE and Firefox allow this to happen without so much as even a warning.

For more information on cross domain, cross frame communication, see Same origin policy.

Also, from here (on same-origin policy):

One exception to this rule is when the document.domain property is set. This exception stipulates that in an FRAME/IFRAME situation, documents served from different subdomains of the same base domain may access each other's DOM tree if both pages set their respective document.domain property to the base domain.

This doesn't happen in the capitalone.com pages, hence the fix in the original link.

Edit: Also, writing software for a Mac takes much more time to develop than writing code that works on the major web browsers. This is because Windows, Linux, Mac, and et al all mostly use their own standards and systems for compiling, interpreting, and running code. This is very good for the OS manufacturer (like Microsoft), as users who want to use a different OS, but can't find replacements for their favorite software, will probably not switch for the sake of lack of software.

Web browsers follow the same standards, which makes it easier to create cross-browser websites than it is to make cross-platform applications.

Edited by Ax238, 30 November 2007 - 02:57 PM.

[Tal]

Edit: Also, writing software for a Mac takes much more time to develop than writing code that works on the major web browsers. This is because Windows, Linux, Mac, and et al all mostly use their own standards and systems for compiling, interpreting, and running code. This is very good for the OS manufacturer (like Microsoft), as users who want to use a different OS, but can't find replacements for their favorite software, will probably not switch for the sake of lack of software.

Web browsers follow the same standards, which makes it easier to create cross-browser websites than it is to make cross-platform applications.

That was my point