Check for cross-origin rather than cross-domain when enabling synthetic devicemotion events.

[wmatyjewicz]

Listening to synthetic devicemotion events is currently enabled on iOS when polyfill is used a inside cross-domain but iOS blocks devicemotion events for cross-origin iframes, where protocol, domain and port are taken into consideration.

Util.isInsideCrossDomainIFrame could be changed into Util.isInsideCrossOriginIFrame in the following way:

Util.isInsideCrossOriginIFrame = function() {
  var isFramed = (window.self !== window.top);
  var refOrigin = Util.getOriginFromUrl(document.referrer);
  var thisOrigin = Util.getOriginFromUrl(window.location.href);

  return isFramed && (refOrigin !== thisOrigin);
};

Util.getOriginFromUrl = function(url) {
  var domainIdx;
  var protoSepIdx = url.indexOf("://");
  if (protoSepIdx !== -1) {
    domainIdx = protoSepIdx + 3;
  } else {
    domainIdx = 0;
  }
  var domainEndIdx = url.indexOf('/', domainIdx);
  if (domainEndIdx === -1) {
    domainEndIdx = url.length;
  }
  return url.substring(0, domainEndIdx);
};

[cvan]

thanks for filing. this is useful information.

couldn't you instead replace all this with window.self !== window.top && window.top.origin !== window.self.origin?

btw, if you need to keep the other code, Util.getOriginFromUrl could be replaced with this:

Util.getOriginFromUrl = function (url) { return new URL(url).origin; };

or to support older browsers:

var a = document.createElement('a');
Util.getOriginFromUrl = function (url) { a.href = url; return a.origin; };

[brianchirls]

It may also be useful to check document.domain. If the iframe has a sandbox attribute without the allow-same-origin permission, it will have a "null origin" and document.domain will be an empty string. Not clear if that's necessary though.

[jsantell]

Fixed in 71eb215 in 0.10.1