[tlb]

Ubiquiti routers have a fairly magical browser SPA that can run on their domain and talk to local routers. It involves webrtc connections to local addresses.

But I think if same-origin were enforced more strictly, they could have found another way.

[Macha]

Huh, I never looked but always assumed this was proxying through the controller.

[tlb]

It does this most of the time, either through the cloud or direct to the controller. But during setup of the first device on a network it does something direct from the browser to get it connected to the cloud.

[SmallPeePeeMan]

How is this different than the admin page for any other router brand? (SPA does not seem relevant to this discussion)