Restrict what popupOptions fields are used

[hzalaz]

For now only width and height

[codecov-io]

Codecov Report

Merging #383 into master will increase coverage by 0.17%.
The diff coverage is 100%.

@@            Coverage Diff             @@
##           master     #383      +/-   ##
==========================================
+ Coverage   97.51%   97.68%   +0.17%     
==========================================
  Files          34       34              
  Lines        1166     1166              
  Branches      195      195              
==========================================
+ Hits         1137     1139       +2     
+ Misses         29       27       -2

Impacted Files	Coverage Δ
src/web-auth/popup.js	93.87% <100%> (+1.02%)	✅
src/helper/parameters-whitelist.js	100% <0%> (+9.09%)	✅

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 7b7f43a...e5c280e. Read the comment docs.

[anulman]

@hzalaz @luisrudge why was the decision made to only cover width & height? I would love to see more options, especially a top and left that override the default computations.

Rationale: I tried to call webAuth.popup.authorize(...) from a Chrome extension's background script, but it causes the popup to open near top=0&left=0 because the caller has no window position.

In order to position the popup in the intended center, I must window.open(...) to a local HTML file that exists solely to call webAuth.authorize. I cannot even use Lock directly in this window, because Chrome Extensions' CSP does not permit loading Lock from the CDN.

(This Lock indirection makes the handling for initialScreen extra awkward, but that's another Issue for another day. I'm presently monkeypatching webAuth.client.buildAuthorizeUrl to append it as a search param, which throws an error on the auth page 😂)

[luisrudge]

I don’t remember the reasoning. Send a PR with top and left and I’ll merge it. Luís

…

________________________________ De: Aidan Nulman <notifications@github.com> Enviado: Sunday, April 28, 2019 2:20:22 PM Para: auth0/auth0.js Cc: Luís Rudge; Mention Assunto: Re: [auth0/auth0.js] Restrict what popupOptions fields are used (#383) @hzalaz<https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fhzalaz&data=02%7C01%7C%7C17624eef627547da156308d6cbfdcc9a%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636920688245043417&sdata=R9zDVaAkBJ%2F7jwoPoGEwAWKlpZdvRwxyym95hZFpgAI%3D&reserved=0> @luisrudge<https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fluisrudge&data=02%7C01%7C%7C17624eef627547da156308d6cbfdcc9a%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636920688245053422&sdata=DFyTrTLUEesDERLT5ttKw8kmMxK8ny39VNprVCGQi10%3D&reserved=0> why was the decision made to only cover width & height? I would love to see more options, especially a top and left that override the default computations. Rationale: I tried to call webAuth.popup.authorize(...) from a Chrome extension's background script, but it causes the popup to open near top=0&left=0 because the caller has no window position. In order to position the popup in the intended center, I must window.open(...) to a local HTML file that exists solely to call webAuth.authorize. I cannot even use Lock directly in this window, because Chrome Extensions' CSP does not permit loading Lock from the CDN. (This Lock indirection makes the handling for initialScreen extra awkward, but that's another Issue for another day. I'm presently monkeypatching webAuth.client.buildAuthorizeUrl to append it as a search param, which throws an error on the auth page 😂) — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub<https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fauth0%2Fauth0.js%2Fpull%2F383%23issuecomment-487398856&data=02%7C01%7C%7C17624eef627547da156308d6cbfdcc9a%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636920688245063433&sdata=6CAsU0rrGxP2tsHjHtaes5vM8hkLn7fumY6Zk4OlSdY%3D&reserved=0>, or mute the thread<https://nam03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fnotifications%2Funsubscribe-auth%2FAAHFYE4QCVB767KJVTH73S3PSXMFNANCNFSM4DDCTCDQ&data=02%7C01%7C%7C17624eef627547da156308d6cbfdcc9a%7C84df9e7fe9f640afb435aaaaaaaaaaaa%7C1%7C0%7C636920688245073438&sdata=VpVKCp23MNNjSibUw2%2FLjH6FnIgaZzMQb7vTS8Ql8jY%3D&reserved=0>.