Follow-up: Removing directives on June 1st

To increase app security, we will remove the allow-top-navigation and allow-top-navigation-by-user-activation directives from iframes on June 1st, 2024.

These directives enable apps to redirect customers from their monday account to another website, which poses a security risk for many customers.

Here are good and bad examples of what’s currently allowed:

// Open link in a new tab - GOOD"<">, "mozillaTab");

  // Open link in a new window - GOOD"<",'name','height=300,width=650,screenX=400,screenY=350'>)

  // Redirect the user outside of monday - BAD = "<">;

After deprecating these directives, any links utilizing this functionality won’t work but won’t impact app functionality. This update will only (see example below): = "<">;

If you need to direct customers to an external link from the app, you can still do so by opening it in a new tab using the SDK or the method."<">, "mozillaTab");