Detect when iframe is cross-domain, then bust out

2019-01-24 05:57发布

站内文章 / JavaScript
30 0 0

问题:

I have a page with a large iframe that contains a majority of the content. The user interacts with the website by clicking around within the iframe. The functionality I'm trying to build is: When a user navigates away from my site, I do them a favor and bust out of the iframe.

The iframe has an onload event which is fired every time a new page is loaded, cross-domain or not.

<iframe id="testframe" src="http://mysite.com" onload="testframe_loaded()"></iframe>

Each time the event is fired, I'm looking for some way to:

A) Detect when the user navigates to a different domain

B) Bust out of the iframe.

I suspect that B isn't possible, since browsers don't give access to

document.getElementById("testframe").contentDocument.location.href

when the iframe is cross-domain. I'm also not sure whether or not A is possible.

If anybody has ideas as to how to accomplish this, or is positive that it can't be done, I'd appreciate the advice.

Thanks

回答1:

You can do A, since if you get a security error (which you can catch), that's means they're cross-domain :) Then you can resize the iframe to be the whole page. But I think you're right you can't actually bust out, without explicit cooperation from the other domain.

EDIT: You're right you don't need to poll. Here's the basic code:

<html>
<head>
<title>Cross-domain frame test</title>
<!-- http://stackoverflow.com/questions/2365822/detect-when-iframe-is-cross-domain-then-bust-out-of-it/2365853#2365853 -->
<script type="text/javascript">
function checkForCross()
{
  var iframe = document.getElementById("myFrame");
  try
  {
    var loc = iframe.contentDocument.location.href;
  } catch(e)
  {
    iframe.setAttribute("style", "border: 0; margin: 0; padding: 0; height: 100%; width: 100%;");
  }
}
</script>
</head>
<body>
<iframe name="myFrame" id="myFrame" src="child.html" style="height: 50%; width: 50%;" onload="checkForCross()"></iframe>
</body>
</html>


回答2:

set the 'target' attribute on external links to '_top'.



回答3:

This works for chrome at least (not tester on other browsers)

   if(parent.location.host != undefined){ 
       alert("hello world!");
    }else{
       throw "cannot access parent!";
    }

It will still throw the "unsafe javascript attempt" warning, but this doesn't stop code execution. Instead the variable is returned as undefined.



标签： javascript security iframe cross-domain
举报

收藏的人(0)

Ta的文章 更多文章
登录 后发表评论
0条评论
还没有人评论过~