rstudio/shiny — pull request #268 by jjallaire (2013-10-09 15:26:54+00:00)
Title: send disconnected message to parent frame when running on localhost

Note that this verifies that both the application and the parent frame are on localhost before sending the message. I'm not sure however what exactly that is buying us, as all the postMessage does is send the string "disconnected" to anyone who is listening. It doesn't strike me that this opens up any exploits (no actual code is exchanged or evaluated) and it might be generally useful for anyone hosting a shiny app to know if/when it is disconnected.

So I'd propose that we remove the localhost qualification -- let me know what you think.