4

I have two domains:

sub1.domain.org contains an iframe with its src pointing to the other: sub2.domain.org

On sub2:

//triggers a cross-domain security error
alert(window.parent.location.href);

//executes just fine on FF, IE, Chrome, and Safari.
window.parent.location.href = new_url; 

So it appears I'm allowed to write to the parent window's URL, but I'm not allowed to read it. Is that really the standard? I just need to know why this is working as it does.

I found one answer here: Why can a child redirect a parent frame?

the Same origin policy doesn't apply here, either. By changing the url in the address bar in your browser window, you're changing the window.top.location.href property, too. If there were same-origin restrictions there, the internet would be dead. You're not sending a request to another location, you're not getting data from a third-party resource and loading it in your page, you're redirecting the browser to another location, which closes and clears the DOM.

But this answer prompts other follow up questions.

When we change the parent's URL, aren't we still technically modifying the parent's DOM (even if it closes it) and therefore violating the same-origin policy?

How exactly would the internet be dead if the same origin policy applied here? Surely we can differentiate manually entering URLs in the address bar from changing it via scripts on separate domains.

I understand that this case is not violating the same-origin policy, but I'm still struggling to understand exactly why. Can anyone shed additional insight as to why this is allowed?

1
  • 1
    Please excuse me for I'm kind of an idiot who's been bit shifting too long but is it really considered cross site scripting if the domain is the same (domain.org from example above)? I mean I realize that subdomains are simply mapped to IP addresses but the ownership cannot be divided. Whoever owns sub1.domain.org, also has ownership of sub2.domain.org 100% of the time? I agree that your report about not being able to read it seems dumb, in this case I'm suggesting the read error is a false negative and should be changed. Perhaps I'm incorrect about the legality of selling subdomains.
    – Jesse Ivy
    May 7, 2015 at 16:21

1 Answer 1

3

It is not a security problem for an iframe to change the URL of a parent window. That just loads a new page into the parent window (thus killing the iframe that was contained in the original parent). There's no security issue there.

The iframe from a different origin is (as you have noticed) not allowed to access the content of a parent as that could be a security issue.

FYI, the reverse is also true. A parent frame can create an iframe and set it's .src to whatever it wants, including other domains, but cannot access the content that loads. The core issue here is that it is not a security problem to display content from other domains, but it can be a security issue to access the actual content from a different origin. So, you're generally allowed to display whatever you want, just not access it.

FYI, the ability to detect whether you are being framed and "bust" out of the frame by resetting the parent window source URL is known as "frame busting" and it is considered a content provider's right to decide whether or not they can be framed or not or who they can be framed by. There are now newer controls that specify whether a site can be framed or not so frame busting is not required in newer browsers.

2
  • You can access an iframe's content. var $iframe = $("#iframeID").contents(); $iframe.find('selector');
    – OG Sean
    Aug 6, 2018 at 19:53
  • 2
    @OGSean - only if same domain.
    – jfriend00
    Aug 6, 2018 at 20:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.