My site is built on the zend framework. I have a link on my site that opens an iframe in order for a user to post to twitter. I can lo开发者_C百科ad the iframe just fine, but if the user has not yet authorized twitter, the iframe redirects to the twitter authorization page, and then back to my site.
When I test the flow by hitting the page directly that loads into the iframe, everything works fine. However, within the iframe, the redirects do not load, so the iframe is simply a blank page.
My redirect from within the page loaded in the iframe looks like this:
return $this->_helper->redirector->gotoUrl("http://twitter.com/oauth/authorize?oauth_token={$session->token}");
The reason, twitter has disabled this, is that you can't see the address bar in an iframe. So web apps could do easy fishing: telling the user to input his/her twitter user/passw into a form which just looks like the twitter sign in form, but is in fact hosted on the fishing server.
精彩评论