2

F.e. I have such code

index.html

<html>
<head>
    <meta charset="utf-8">
</head>
<body>
    <iframe src="iframe.html"></iframe>
</body>
</html>

iframe.html

<html>
    <head>
        <script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.js"></script>
    </head>
    <body>
        <script>
            $.get("http://badsite.com");
            $.get("http://goodsite.com");
        </script>
    </body>
</html>

As you can see iframe make two request and how can I block requests to http://badsite.com What I need to use js, php, or should configure my server or change my .htaccess file?

6
  • Why are you looking to do that? What are you exactly trying to do? Jan 18, 2019 at 14:37
  • I am trying to block ads thats load into iframe Jan 18, 2019 at 14:50
  • @АрыстанКалиакпаров — Loading other people's content on to your own website while stripping out their adverts has really nasty legal and ethical implications. Don't.
    – Quentin
    Jan 18, 2019 at 15:24
  • I am doing for personal use. I am trying to blocking ad because of it contains link to virus site Jan 18, 2019 at 15:31
  • If you're doing it for personal use, then use a browser extension like Ghostery or Adblock Plus.
    – Quentin
    Jan 18, 2019 at 15:51

2 Answers 2

0

HTML5 introduces the sandbox attribute on the iframe that, disables JavaScript loading and execution.

3
  • @Quentin , sample iframe code contains only AJAX requests, so this solution suits well for example ;) Jan 18, 2019 at 15:13
  • It contains two Ajax requests and the OP asked how to block one of them.
    – Quentin
    Jan 18, 2019 at 15:24
  • @Quentin , hm, you are right... that is difficult to do Jan 18, 2019 at 15:47
0

Set up a CSP with connect-src.

You can't block badsite specifically, but you can allow only goodsite (or a list of sites that includes goodsite).

Your HTTP response headers for iframe.html should include:

Content-Security-Policy: connect-src http://goodsite.com http://different-goodsite.com

You could also use a meta element.

<meta http-equiv="Content-Security-Policy" content="connect-src http://goodsite.com http://different-goodsite.com">
2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.