Question

I have page(lets say https://example.com/dir1/tidy.html), that embeds an iframe that hosts content from another domain (lets say https://foobar.com/dir2/whatsup.html). If the user presses Cancel inside the embedded iframe page, is it possible to redirect the parent/container page to a different url (like https://example.com/dir2/yeah.html)? How do I accomplish this?

I’d have thought that since the iframe page belongs to a different domain, the same-origin-policy would stop me from using javascript to send events/actions to the parent page.

Answer 1

The same origin policy prevents you from reading data from the document on the parent domain.

It doesn’t stop you from:

top.location = "foo bar baz";

Or even just:

<a href="foo bar baz" target="_top">...</a>