Cross-origin iframes

[Rouslan Solomakhin]

Hi experimentation-dev!

Can a cross-origin iframe use origin trial features? For example, if there's a feature X that https://iframe.com wants to use without modifying https://top-level.com, can https://iframe.com enable the origin trial for itself in its own HTTP headers or HTML <meta> tag?

Cheers,

Rouslan

[Jason Chase]

Origin trials are enabled independently for each execution context, be that a top-level document, iframe, service worker, etc. So, a cross-origin iframe can enable trials via its own HTTP headers/<meta> tag, and in fact that is the only way to do so. The enabled state of origin trials are not inherited in iframes from their parent, regardless if they are same-origin or cross-origin.

Hopefully that clarifies things. Let us know if you have any other questions.

Thanks,

Jason

--
You received this message because you are subscribed to the Google Groups "experimentation-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to experimentation...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/experimentation-dev/b674f694-361d-41eb-97c7-4ceb64eaef6an%40chromium.org.

[Rouslan Solomakhin]

Very interesting! So service workers can enable origin trials, too? Please correct me if I'm wrong: service workers can enable origin trials only through HTTP headers on the service worker JS file. Right?

[Jason Chase]

Yes, that's correct for service workers. The token(s) provided in the HTTP header are cached/revalidated when the service worker is started again (i.e. not just at install time when the JS file is run).