There is no error in the requirement itself, but the error is implementation.

I have summarized the concept of flying clouds. I could have used this question to write a paper, but it was put on hold out of inertia. If you want to install bi in English, you can write as follows: The requirement itself has no fault, the problem is whether the implementation is secure enough. I think the demand should be met as far as possible. It should not be said that the demand is wrong, and there will be rationality if there is a demand. The problem often lies in the implementation of requirements. Implementation may lead to errors, and there may be security problems.. The cross-domain pape of eggplant in webzine 0x03R: This is a problem. Window. location for browser developers, they may thinkA child window can write to a parent window or to a Child Window (including cross-origin ).Is a browser feature. It is a requirement and cannot be counted as a vulnerability. What I want to say is that this requirement should be met, but we can consider how to make it safe. For this example, it is typical to restrict the write pseudo-Protocol (javascript ). However, writing pseudo-protocols is not allowed here, which may cause phishing problems, because cross-origin writing is allowed. Therefore, whether or not the demand should be relaxed is involved. I think,If there are technical difficulties in implementation, you can adjust the needs as appropriate to meet the implementation needs. However, this does not mean that there is a problem with the demand itself, but because it is difficult to meet the demand under the existing technical conditions or to adjust the demand out of cost considerations. Security Technology is also a kind of technology, and demand is the driving force of technological development. Security Technology has a similar relationship with technical implementation requirements in terms of security requirements. In another example, CSS History Hacking (you can refer to sirdarckcat, Gareth Heyes's blog and anehta has also implemented scan History records). browser developers also think this is a browser function, in a sense, this is indeed the case, but security issues also exist, because this feature is easy to use, so it is a problem of implementation. If you share the same feelings, you can follow the post to give some similar examples.