Question

In the JavaScript for the <iframe> I need to call a function in the parent window. Both windows are from the same domain.

Is it safe to use window.parent.myFunction();?

Answer 1

Short answer

Yes, you can use window.parent from the same domain.

The WhatWG specification chapter 6: Loading Web pages says:

• iframe.parent exists
• iframe.parent is a proxy to the DOM of the iframe‘s parent
• Access is allowed if the origins are the same

Really long, long answer

I am trying to show you how you can come to this conclusion by reading the specification, while keeping in the mind: What are the characteristic traits of accessing parent from within an iframe?

Let’s start. It’s a long text.

1. DOM attribute parent

WhatWG#dom-parent says about window.parent:

The parent IDL attribute on the Window object of a Document in a browsing context b must return the WindowProxy object of the parent browsing context, if there is one (i.e. if b is a child browsing context), or the WindowProxy object of the browsing context b itself, otherwise (i.e. if it is a top-level browsing context or a detached nested browsing context).

parent is an attribute to access something like the DOM of the parent window. However:

• What is a browsing context?
• What does WindowProxy do?

Let’s continue reading.

2. Browsing context

A browsing context is an environment in which Document objects are presented to the user.

WhatWG#Browsing context says:

A tab or window in a Web browser typically contains a browsing context, as does an iframe or frames in a frameset. Each browsing context has a corresponding WindowProxy object.

3. Window proxy

The window proxy is an object to proxy a window object and to enforce, for example, security constraints. For a window object there can be several proxies (for example two iframes from two different domains accessing the same parent).

WhatWG#proxy-object says:

The WindowProxy object allows scripts to act as if each browsing context had a single Window object, while still keeping separate Window objects for each Document.

4. Security

We are almost there. Keep reading.

WhatWG#security-nav says:

A browsing context A is allowed to navigate a second browsing context B if one of the following conditions is true:

• Either the origin of the active document of A is the same as the origin of the active document of B, or
• The browsing context A is a nested browsing context with a top-level browsing context, and its top-level browsing context is B, or
• The browsing context B is an auxiliary browsing context and A is allowed to navigate B’s opener browsing context, or
• The browsing context B is not a top-level browsing context, but there exists an ancestor browsing context of B whose active document has the same origin as the active document of A (possibly in fact being A itself).

5. Deduction

Can an iframe access functions from its parent, if both are from the same domain? Lets deduce.

1. parent is not the window object of the parent, but a WindowProxy.
2. The browsing context of the iframe can access its parent, because they both have the same origin (see the first security condition above).

You see: If you read a specification carefully, you can find answers how browsers should behave. Reading specifications is an acquired skill. It needs patience and exactness.

However: The world is not so nice. There are browsers which do not implement specifications as well as they should. Caveat emptor.