Azure / Azure/api-management-developer-portal
Allow-same-origin flag in custom HTML widgets
- Dominant language
- TypeScript
- Stars
- 545
- Forks
- 360
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
I'm trying to show a Hubspot form embed code in a custom HTML widget:
```
hbspt.forms.create({
portalId: "9999999",
formId: "xxxx",
sfdcCampaignId: "yyyy",
});
```
When I try to view in the published developer portal, I get this error at browser's console:
```
Uncaught DOMException: Failed to read the 'cookie' property from 'Document': The document is sandboxed and lacks the 'allow-same-origin' flag.
at Object.getCookie (https://js.hsforms.net/forms/v2.js:1:411482)
at Object.getUtk (https://js.hsforms.net/forms/v2.js:1:556218)
at Object.s [as create] (https://js.hsforms.net/forms/v2.js:1:567835)
at about:srcdoc:9:21
```
Thanks
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the custom HTML widget sandbox configuration and reproduce the HubSpot embed in the published developer portal while watching the browser console. Determine how the sandbox policy handles the allow-same-origin requirement and verify that the chosen behavior supports the embed without weakening the portal's security boundary.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- html, javascript, typescript
- Domain
- frontend, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100