How can I prevent JavaScript in an iFrame to acces

2019-01-28 02:33发布

站内问答 / JavaScript
558 2 6

Basically I want to have an iFrame which always restricts it's content as if it comes from a different domain, even if the content comes from the same origin.

Is there any way to do this?

2条回答
聊天终结者
2楼-- · 2019-01-28 03:07

The best solution is probably to use the HTML5 sandbox attribute on the iframe, which (by default) explicitly disables both scripting and same-origin access to the parent DOM.

Good introduction at http://msdn.microsoft.com/en-us/hh563496.aspx

As of Dec 2012, this seems to be supported on most current browsers.

查看更多
0人赞 添加讨论(0) 举报
甜甜的少女心
3楼-- · 2019-01-28 03:19

This will hide window.parent in the child frame/window, but not the top property.

BUT the window.parent property is STILL accessible till the end of the onload event of the child window/frame.

<html>
  <head>
    <style type="text/css">
      #wrapper {width:1000px;height:600px;}
    </style>
    <script type="text/javascript">
      window.onload = function() {
        var frm = document.getElementById('childFrame');
        var win = frm.contentWindow || (frm.contentDocument && frm.contentDocument.parentWindow) || (frm.document && frm.document.parentWindow);
        if (win) win.parent = null;
      }
    </script>
  </head>
  <body>
    <div id="wrapper">
      <iframe id="childFrame" src="child.html" frameborder="0" style="width:100%;height:100%;"></iframe>
    </div>
  </body>
</html>
查看更多
0人赞 添加讨论(0) 举报
登录 后发表回答
相关问题
查看全部
相关文章
查看全部
收藏的人(6)