get the parent url of iframe in PHP

Question

I am creating a widget that would load in a IFrame and users will be able to place the widget on their own website. How would I get the URL of the website that is using the IFrame in javascript and/or PHP? The IFrame loads a php file.

I have tried "parent.top.location.href" and "parent.document.referrer" in the IFrame page but that is undefined.

I have also tried to echo "$_Server[referrer]" in the IFrame page and that did return the IFrame parent URL, but how easy is it for someone to manipulate the referrer variable? I dont want to get misleading information. The Goal: I created a widget and want to allow registered users to use that widget on their site. I want to be able to find out who is using the widget and if a un-registered user is using it on their site, then the widget would not display

Answer 1

Assuming your widget's URL doesn't do any redirects, etc., you should be able to use:

document.referrer

from within the javascript inside your iframe and it should contain the URL of the parent page. This seems to be what YouTube does for tracking in their iframe embed codes.

Answer 2

I have also tried to echo "$_Server[referrer]" in the IFrame page and that did return the IFrame parent URL, but how easy is it for someone to manipulate the referrer variable?

Pretty easy, but so is disabling JavaScript! However, if a web site uses your <iframe> it will be a little difficult for them to fake the referrer in their visitor's UA. (They could also proxy your content if they really insist on hiding the fact that they're using your content. In that case your only choice is not to publish it in the first place.)

In order to present content for "partners" only you could consider providing them with a token (like Twitter/Google/... APIs). If no (or an invalid) token is used, present an error. If a valid token is used but the referrer is suspicious you should investigate further.

Answer 3

A small piece of JavaScript in the iframe-d page can 'un-frame' the page:

if (top != self) {top.location.replace(self.location.href);}

Otherwise, as @mck89 says: the iframe can access the URL of the parent page using the top.location.href.

Further reading on the question How to prevent my site page to be loaded via 3rd party site frame of iframe.

Answer 4

Try with:

parent.location.href;

or

parent.document.URL

Answer 5

You can use the following PHP code to have the parent window URL get values in an array:

  <?php
       //Getting the parent window parameters
        $getURLVar = str_replace("?","",strrchr($_SERVER['HTTP_REFERER'],"?"));
        $getURLVar = str_replace("&","=",$getURLVar);
        $getURLVar = str_getcsv($getURLVar,"=");
        $i=0;
        foreach ($getURLVar as $value)
          {
            if ($i % 2)
                $value1[$i]=$value;
            else
                $value2[$i]=$value;

            $i++;
          } 
        $getURLVar =array_combine($value2,$value1);


        print_r($getURLVar);
    ?>

Answer 6

I would use:

$qStr = explode('?', $_SERVER['HTTP_REFERER']);        
$t= explode('&', $qStr[1]);
foreach ($t as $val)
{
    $a = explode('=', $val);
    $args[$a[0]]=$a[1];
}
// to check the arguments
print_r($args);
// to check the url
echo $qStr[0];

$args would contain my security token which would be checked by some hashing against the url