Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Get parent document origin for cross-domain HTTPS iFrame

I want to read window.top.location.origin from inside an iFrame.
The parent and iFrame are on different HTTPS domains.
Trying to access that throws a security error in Chrome for example.
[DOMException: Blocked a frame with origin "..." from accessing a cross-origin frame.]

Is it at all possible to do that without triggering the error?

I need window.top's origin because I send different postMessages based on that origin.

like image 480
Francisc Avatar asked Oct 15 '25 16:10

Francisc


1 Answers

I know this is old, but maybe it helps others:

The full Parent URL will appear to the <iframe/> as document.referrer. With that, you can parse it locally to find the URL specifics you may need.

if (document.referrer !== location.href) {
  let foo = document.createElement('a');
  foo.href = document.referrer;
  console.log('origin is:', foo.origin);
}

Of course, this is thanks to the anchor tag's built-in parsing. Hidden gem~!

like image 170
lukeed Avatar answered Oct 18 '25 07:10

lukeed