0

I loaded a website of my own design in an iframe. This website contains links to other cross-domain pages. I wrote a javascript function to retrieve the title of the current page contained in the iframe, but when I run my application at localhost:3000, I get the error:

Uncaught DOMException: Blocked a frame with origin "http://localhost:3000" from accessing a cross-origin frame.

Even when I am using this javascript method on the page that was originally loaded in the iframe, I still get the same error. I would like to know exactly what is causing this error.

1 Answer 1

2

The Same Origin Policy is a security feature that protects user data across origins.

Consider what would happen if you loaded my webmail service into a frame on your site and were then able to access the DOM of that page. This would be a security disaster.

Even just reading the title could expose if I was logged in (and thus had an account on the site) or not (and probably don’t) which would be useful information for constructing a phishing attack.

6
  • Thanks for the reply and is there an extension or a way to disable this policy?
    – user19759133
    Aug 14, 2022 at 0:30
  • Is this policy related to cors?
    – user19759133
    Aug 14, 2022 at 0:35
  • There are some circumstances where CORS can be used to relax the same origin policy. This isn’t one of them.
    – Quentin
    Aug 14, 2022 at 0:42
  • So if I understand correctly cors has nothing to do with this error, does it?
    – user19759133
    Aug 14, 2022 at 0:47
  • Correct. This is not a circumstance where CORS can help.
    – Quentin
    Aug 14, 2022 at 8:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.