Reputation: 257
Can someone explain how google hangout apps are served? It seems to me that google downloads the manifest.xml from a public url you specify, then reserves the html in the content tag. How does google prevent the javascript in that content from manipulating the clients cookies for the google hangouts domain?
Upvotes: 1
Views: 1070
Reputation: 878
The hangout app is served in an iframe with a different domain than the container page. The only way you can effectively communicate with the container page is through the Hangouts API, which uses some special cross-browser tricks to cross the domain barrier.
Specifically, the Hangouts API uses Google Gadgets RPC to communicate with the parent page on the Google Hangouts domain.
Upvotes: 5