I know that, for security reasons, javascript can't read the contents of an iframe if it belongs to a different domain. This makes sense, given that the entire page could be an iframe with snooping scripts outside of the frame. The question is - are there equal limitations in the other direction? Can javascript within an iframe (from a different domain) read and manipulate the dom in its parent window? Thanks!

You can't. This would be a security hole. Now that everyone is crazy adding facebook iframes to their sites, imagine if javascript from FB could interact with your page ;) Anyway, i set up a small example, and got the same origin warning when i tried to get a parent's div from inside the iframe (which was in another domain)

Javascript iFrame Limitations

Tags:

javascript

iframe

I know that, for security reasons, javascript can't read the contents of an iframe if it belongs to a different domain. This makes sense, given that the entire page could be an iframe with snooping scripts outside of the frame.

The question is - are there equal limitations in the other direction? Can javascript within an iframe (from a different domain) read and manipulate the dom in its parent window?

Thanks!

360

asked May 12 '10 00:05

Matrym

1 Answers

You can't.
This would be a security hole. Now that everyone is crazy adding facebook iframes to their sites, imagine if javascript from FB could interact with your page ;)
Anyway, i set up a small example, and got the same origin warning when i tried to get a parent's div from inside the iframe (which was in another domain)

111

answered Oct 22 '22 23:10

Gonçalo Queirós

Related questions
                            
                                Is HTML 5 supported by all the main browsers?
                            
                                Client Side Persistence (Storage)
                            
                                How do you undo "surroundContents" in javascript?
                            
                                Greasemonkey Storage
                            
                                Attributes.Add Onclick Event in c# code behind
                            
                                Dynamically including javascript files only once
                            
                                Regex for file path validation in javascript
                            
                                Matching one-line JavaScript comments (//) with re
                            
                                Create Firefox Addon to Watch and modify XHR requests & reponses
                            
                                Google Maps: How to add HTML elements to specific coordinates?
                            
                                jQuery: How can I add line break to form input?
                            
                                How can I simulate a non-responding server?
                            
                                Prototypal inheritance: Can you chain Object.create?
                            
                                One page web apps and inline javascript and CSS
                            
                                How to not allow parts of sortable jquery list to move?
                            
                                Properly registering JavaScript and CSS in MVC 2 Editor Templates
                            
                                JavaScript regular expression literal persists between function calls
                            
                                Setting hidden input value in Javascript, then accessing it in codebehind
                            
                                Managing active state
                            
                                jQuery exception if element doesn't exist

Donate For Us

If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!

Donate Us With