Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Understanding Cross-Domain issue in Iframes

This question might seem silly but I need to understand this for clarity.

According to my understanding, cross-domain problem is when the domain of the webpage which contains the IFRAME is different from the domain of the web-page opened in IFRAME.

Going by that logic, nothing should open in IFRAME ever.

When I embed a web-page "bottom:10700" in the IFRAME of my web-page "top:9700", it gives error.I am not able to see the contents in IFRAME. Error is Access denied in accessing property 'constructor'

I am getting the error while accessing the contructor (_1.contructor)

isc.A.Function=function isc_isA_Function(_1){
  if(_1==null) return false;
  if(isc.Browser.isIE&&typeof _1==this.$a7) return true;
  var _2=_1.constructor;
  if(_2&&_2.$k!=null){
    if(_2.$k!=1)return false;
    if(_2===Function)return true
  }

This script is run when home page of bottom is opened in an iframe contained in top.

Is there any way, I can make this work. I mean can I set both the domains to be same. I don't have access to remote site's script.

Is resizing the frame after redering it once a cross-domain scenario. If not, then certainly remote site is trying to access the IFRAME element..How can I debug this??

like image 531
user1522820 Avatar asked Jan 07 '13 14:01

user1522820


People also ask

What is cross domain iframes?

Learn about how cross-domain iframe can be used to safely circumvent browser restrictions on scripts that process code in a different domain. Applies to: Skype for Business 2015. Web applications that interact with UCWA 2.0 resources require a cross-domain iframe for all HTTP requests sent to UCWA 2.0.

How do you know if an iframe is cross domain?

to select the iframe with querySelector . Then we define the canAccessIFrame function that checks if the iframe has the contentDocument property defined. If it's defined then it's not a cross-domain iframe or it's cross domain and cross domain is allowed. Otherwise, false is returned.

How do I access cross domain iframe?

To access cross-domain iframe, the best approach is to use Javascript's postMessage() method. This method provides a way to securely pass messages across domains.


2 Answers

Cross-domain issues are about the communication between iframes. You can always embed any iframe but, if domains differ, iframes cannot interact with each other e.g. execute JS, modify DOM etc.

HTML5 provides a sandbox property that re-enables particular features of the cross-domain iframe interaction. Be careful, it can be dangerous.

like image 100
oleq Avatar answered Oct 01 '22 16:10

oleq


It is normal behavior for a page xyz.com to load in an iframe hosted on abc.com. However, you cannot change anything or access its content via code from parent abc.com.

Hope this helped.

like image 44
semir.babajic Avatar answered Oct 01 '22 17:10

semir.babajic