Botframework-webchat: IE11 windows opened by Action.OpenUrl from an Adaptive Card is not resizable or scrollable

[gudatcomputers]

Screenshots

Version

4.9.1+ - downloaded from CDN, hosted locally

We are using webchat-es5.js with HealthBot.

When using IE11 (11.1685.16299.0), when choosing Action.OpenUrl from an Adaptive Card the opened window is fixed size with no scrollbars.

Not sure if the fix [#3223] is the cause, but this issue occurs first in 4.9.1

Steps to reproduce

1. Open any HealthBot scenario with an Action.OpenUrl Adaptive Card
2. Click the link
3. See the window opened with a fixed size and no scrollbars

Expected behavior

window that opens as a result of Action.OpenUrl is scrollable and resizable

[tsuwandy]

@corinagum, could you take a look?

[corinagum]

@gudatcomputers please provide the Adaptive Card you are using that reproduces this scenario.
What question flow on the Health Bot needs to be followed in order to produce the Adaptive Card?

[gudatcomputers]

@corinagum Here's the card content.. basic card. As far as having a public version of it, I had to roll it back to 4.9.0 to address the issue. Is that crucial?

{
    "$schema": "http://adaptivecards.io/schemas/adaptive-card.json",
    "type": "AdaptiveCard",
    "version": "1.0",
    "body": [],
        "actions": [
        {
            "type": "Action.OpenUrl",
            "title": customLocalizedStrings['testing_answer_test_type_home_test'],
            "url": scenario.signupFormBaseUrl +"?testType=in-home"&conversationId=" + scenario.scenarioArgs.conversationId 
        },
        {
            "type": "Action.OpenUrl",
            "title": customLocalizedStrings['testing_answer_test_type_test_site'],
            "url": scenario.testLocatorUrl + "?conversationId=" + scenario.scenarioArgs.conversationId
        },       
    ]
}       

[corinagum]

@gudatcomputers First let me try and get a repro on our Web Chat bot first, and I'll get back to you. :)

[corinagum]

I'm able to reproduce this outside of Web Chat on IE11, using noopener with the following:
window.open('https://github.com/Microsoft/BotFramework-WebChat', '_blank', 'noopener')

Ideas/options:

1. Remove rel if browser is IE11 - not recommended, since this is a security change
2. Remove target if browser is IE11?
3. No action, means continued broken behavior in IE11 only.

Currently, I am investigating other options to ensure we choose the securest option. I will report back.

@gudatcomputers thanks, for now I don't need anything from the Health Bot. :)

[gudatcomputers]

Thanks @corinagum we're, obviously, functional on 4.9.0 for now. Thanks for looking into alternatives.

[corinagum]

After doing some research, I think the best solution is to isolate a separate behavior for IE11, which would be to assign noreferrer, but not noopener, then manually set window.open to null, which resolves original issue when tested.