Re: [openstreetmap/openstreetmap-website] Add Cross-Origin-Opener-Policy header (2ff4d6a)

2025-07-08 Thread Emilio Mariscal via rails-dev
Security is always a priority, thanks @tomhughes for the fix. 

We've already made the corresponding 
[changes](https://github.com/hotosm/tasking-manager/pull/6933) to the HOT's 
Tasking Manager and login is working again.

-- 
Reply to this email directly or view it on GitHub:
https://github.com/openstreetmap/openstreetmap-website/commit/2ff4d6a4e633e479568572090eb6a16074103cd9#commitcomment-161667308
You are receiving this because you are subscribed to this thread.

Message ID: 
___
rails-dev mailing list
rails-dev@openstreetmap.org
https://lists.openstreetmap.org/listinfo/rails-dev


Re: [openstreetmap/openstreetmap-website] Add Cross-Origin-Opener-Policy header (2ff4d6a)

2025-07-07 Thread Emilio Mariscal via rails-dev
> So in the case of https://osmlab.github.io/osm-auth/ it looks like the 
> problem is that final redirect page is trying to access the parent page to 
> pass the authorization code back but I can't see any value for the COOP 
> header that would allow that while not allowing the parent to interfere with 
> the authorisation window.
> 
> I don't know about Rapid or Overpass but the user experience of that osm-auth 
> popup is absolutely horrible in any case...

While I agree that the popup UX is not good, this is breaking login in several 
wide-used tools. Could this change be reverted, make an announcement and give 
some time so dev teams can adjust their tools and move from a popup to a 
redirect?

-- 
Reply to this email directly or view it on GitHub:
https://github.com/openstreetmap/openstreetmap-website/commit/2ff4d6a4e633e479568572090eb6a16074103cd9#commitcomment-161619696
You are receiving this because you are subscribed to this thread.

Message ID: 
___
rails-dev mailing list
rails-dev@openstreetmap.org
https://lists.openstreetmap.org/listinfo/rails-dev