Home/ Questions/Q 191843
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-11T16:22:33+00:00

I have a .jsp that contains an IFrame with a page that has some

  • 0

I have a .jsp that contains an IFrame with a page that has some embedded JavaScript. This JavaScript accesses some DOM elements in the parent page (the one containing the IFrame).

The embedded page is going to be on a seperate sub-domain from the parent page, and I realize that there are some security implications. My impression is that the document.domain of any pages embedded in IFrames must match the document.domain of parent pages for cross-IFrame access to be allowed. The embedded page currently contains the following code to broaden the scope of its security:

document.domain = 'domain.com'; //where domain.com is my domain

It then proceeds to access DOM elements in the parent document.

I am currently testing this, and have modified the hosts file on the Windows machine serving the parent page with the following entry:

127.0.0.1 domain.com

The goal is to trick JavaScript on the parent page into believing that the document in the embedded page is being served from the same domain.

If I then browse to the page on the same machine. Despite the document.domain showing up as domain.com in both my parent and embedded pages as observed through Firebug, I am getting ‘Permission denied’ errors when attempting to get or set DOM properties from JavaScript running in the embedded page.

Am I missing something?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Even though the “document.domain” properties look the same, from the MSDN documentation is sounds like you still have to explicity set them to be the same:

    All the pages on different hosts must
    have the domain property explicitly
    set to the same value to communicate
    successfully with each other. For
    example, the value of the domain
    property of a page on the host
    microsoft.com is “microsoft.com” by
    default. It might seem logical that if
    you set the domain property of a page
    on another host named
    msdn.microsoft.com to “microsoft.com,”
    that the two pages could communicate
    with each other. However, this is not
    the case, unless you explicitly set
    the domain property of the page on
    microsoft.com to “microsoft.com.”

    • 0