Detect when iframe is cross-domain, then bust out

I have a page with a large iframe that contains a majority of the content. The user interacts with the website by clicking around within the iframe. The functionality I'm trying to build is: When a user navigates away from my site, I do them a favor and bust out of the iframe.

The iframe has an onload event which is fired every time a new page is loaded, cross-domain or not.

<iframe id="testframe" src="http://mysite.com" onload="testframe_loaded()"></iframe>

Each time the event is fired, I'm looking for some way to:

A) Detect when the user navigates to a different domain

B) Bust out of the iframe.

I suspect that B isn't possible, since browsers don't give access to

document.getElementById("testframe").contentDocument.location.href

when the iframe is cross-domain. I'm also not sure whether or not A is possible.

If anybody has ideas as to how to accomplish this, or is positive that it can't be done, I'd appreciate the advice.

Thanks

标签： javascript security iframe cross-domain

3条回答

叛逆

2楼-- · 2019-01-24 05:47

You can do A, since if you get a security error (which you can catch), that's means they're cross-domain :) Then you can resize the iframe to be the whole page. But I think you're right you can't actually bust out, without explicit cooperation from the other domain.

EDIT: You're right you don't need to poll. Here's the basic code:

<html>
<head>
<title>Cross-domain frame test</title>
<!-- http://stackoverflow.com/questions/2365822/detect-when-iframe-is-cross-domain-then-bust-out-of-it/2365853#2365853 -->
<script type="text/javascript">
function checkForCross()
{
  var iframe = document.getElementById("myFrame");
  try
  {
    var loc = iframe.contentDocument.location.href;
  } catch(e)
  {
    iframe.setAttribute("style", "border: 0; margin: 0; padding: 0; height: 100%; width: 100%;");
  }
}
</script>
</head>
<body>
<iframe name="myFrame" id="myFrame" src="child.html" style="height: 50%; width: 50%;" onload="checkForCross()"></iframe>
</body>
</html>

0人赞添加讨论(0) 举报

何必那么认真

3楼-- · 2019-01-24 05:53

This works for chrome at least (not tester on other browsers)

   if(parent.location.host != undefined){ 
       alert("hello world!");
    }else{
       throw "cannot access parent!";
    }

It will still throw the "unsafe javascript attempt" warning, but this doesn't stop code execution. Instead the variable is returned as undefined.

0人赞添加讨论(0) 举报

虎瘦雄心在

4楼-- · 2019-01-24 05:58

set the 'target' attribute on external links to '_top'.

0人赞添加讨论(0) 举报

Detect when iframe is cross-domain, then bust out

采纳回答

编辑标签

举报内容

检举类型

检举原因

检举说明(必填)

打开微信“扫一扫”，打开网页后点击屏幕右上角分享按钮

付费偷看金额在0.1-10元之间