How to make Chrome 92 display alert(), prompt() and confirm() from iframe opened on different subdomain

Question

I have this situation:

A page from http://desktop.ourdomain.local contains an iframe with src="http://legacy-application.ourdomain.local"

http://legacy-application.ourdomain.local , makes extensive use of alerts and prompts, which worked fine until google released chrome 92, which states that this is no more an option (see https://www.chromestatus.com/feature/5148698084376576 )

Tried many things among those explained here

• Ways to circumvent the same-origin policy

And many trials about CORS, and many combinations of iframe sandboxing (allow-same-origin allow-scripts allow-modal ...)

Did anybody run into the same problem, and solved ?

Answer 1

As pointed out by @Bravo, google provides a way to "disable" the restriction, at least until they decide to keep it or remove, that will happen on december 15, when releasing chrome 96. here I was able to obtain a token that can be added as value of an "Origin-Trial" header on the pages requiring the feature to be disabled. The token does its job only if the sites are served in https, but this should be easier to solve than rewriting all the forms using alerts and confirms ! In the mean while I have the time to find a definitive solution.