How to disable "web-security" in BrowserWindow?

[kurdin]

This is not working:

mainWindow = new BrowserWindow({
    width: 1100, 
    height: 800, 
    "web-preferences": {
      "web-security": false
    }
  });

Loading any external webpage with iframes will throw errors for every iframe on the page:
Sandbox access violation: Blocked a frame at "http://cnn.com" from accessing a frame at "null". The frame being accessed is sandboxed and lacks the "allow-same-origin" flag.

This is not helping as well:

<iframe sandbox="none" src="http://cnn.com"></iframe>

[deecoolist]

perhaps you forget to set the node-integration to iframe

app.commandLine.appendSwitch('disable-web-security'); // try add this line
mainWindow = new BrowserWindow({
    width: 1100, 
    height: 800, 
    "node-integration": "iframe", // and this line
    "web-preferences": {
      "web-security": false
    }
  });

ref: http://peter.sh/experiments/chromium-command-line-switches/ — List of Chromium Command Line Switches

[kurdin]

No, this is not helping, same errors.
Is there any doc on this command?

app.commandLine.appendSwitch('disable-web-security'); 

looks like it has no effect on application at all.
I even tried:

app.commandLine.appendSwitch('--disable-web-security'); 

and it is not working as well.

[kurdin]

I updated atom-shell to 0.13 and "Sandbox access violation" errors are gone now but again, it seems like line: app.commandLine.appendSwitch('disable-web-security') does nothing.

[zcbenz]

Disabling web-security does allow accessing JavaScript contexts from iframes of other origins, but for setting cookie, the behavior is still disabled under sandboxed iframes. The errors you saw were from the iframes in the iframe of your page, which were out of your control and were sandboxed.

So web security was successfully disabled in your code, it was just that setting cookies across origins was still not allowed under sandboxed iframes, as far as I can see it doesn't hurt normal uses and only throws security exceptions in external pages that we have no control.

[mburakkalkan]

I don't know old versions have dashed property names but they are camelCased webPreferences and webSecurity not dashed for late versions:

mainWindow = new BrowserWindow({
    width: 1100, 
    height: 800,
    webPreferences: {
      webSecurity: false
    }
  });