Same domain IE 9

[seamus-oconnor]

We have run into a problem using Oasis (via Conductor) where we have a widget in an <iframe> we need to communicate to. Both the host page and the <iframe> are on the same domain. Everything works fine in FF and Chrome because they support the iframe.sandbox property.

Testing in IE 9 gets the following error: "Security: iFrames from the same host cannot be sandboxed in older browsers and is disallowed. For HTML5 browsers supporting the sandbox attribute on iframes, you can add the allow-same-origin flagonly if you host the sandbox on a separate domain."

This is correct because of the verifySandbox function defined here:

oasis.js/lib/oasis/iframe_adapter.js

Lines 10 to 28 in b657d0d

	function verifySandbox(oasis, sandboxUrl) {
	var iframe = document.createElement('iframe'),
	link;
	if( (oasis.configuration.allowSameOrigin && iframe.sandbox !== undefined) ||
	(iframe.sandbox === undefined) ) {
	// The sandbox attribute isn't supported (IE8/9) or we want a child iframe
	// to access resources from its own domain (youtube iframe),
	// we need to make sure the sandbox is loaded from a separate domain
	link = document.createElement('a');
	link.href = sandboxUrl;
	if( !link.host || (link.protocol === window.location.protocol && link.host === window.location.host) ) {
	throw new Error("Security: iFrames from the same host cannot be sandboxed in older browsers and is disallowed. " +
	"For HTML5 browsers supporting the `sandbox` attribute on iframes, you can add the `allow-same-origin` flag" +
	"only if you host the sandbox on a separate domain.");
	}
	}
	}

In our case we don't need any of the sandbox security features of Oasis but would like to use it to encapsulate communication between <iframe>s in a sane way. Would it be possible to opt in/out of the security Oasis provides to only use the communication API?