Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Javascript iFrame Limitations

I know that, for security reasons, javascript can't read the contents of an iframe if it belongs to a different domain. This makes sense, given that the entire page could be an iframe with snooping scripts outside of the frame.

The question is - are there equal limitations in the other direction? Can javascript within an iframe (from a different domain) read and manipulate the dom in its parent window?

Thanks!

like image 360
Matrym Avatar asked May 12 '10 00:05

Matrym


People also ask

Why iframe should not be used?

Reason 1: Iframe causes usability issues The content, displayed in the iframe, could break (as it doesn't fit in the iFrame) and therefore look odd. The main purpose of displaying content on your website is to convince your users to book, so it should always look good.

Are iFrames still used in 2021?

<iframe> is not an obsolete or deprecated tag. It's still widelly used in the web, mostly for media purposes.

Can you use JavaScript in an iframe?

As long as the protocol, domain and port of the parent page and iframe match, everything will work fine.

Is iframe a good practice?

If you are using an iframe to get around a properly developed site, then of course it is bad practice. However sometimes an iframe is acceptable. One of the main problems with an iframe has to do with bookmarks and navigation. If you are using it to simply embed a page inside your content, I think that is fine.


1 Answers

You can't.
This would be a security hole. Now that everyone is crazy adding facebook iframes to their sites, imagine if javascript from FB could interact with your page ;)
Anyway, i set up a small example, and got the same origin warning when i tried to get a parent's div from inside the iframe (which was in another domain)

like image 111
Gonçalo Queirós Avatar answered Oct 22 '22 23:10

Gonçalo Queirós