At ZYB we have been doing cross domain JavaScript calls for quite some time now. Whenever we tell that to people, many don’t believe it is possible with standard security settings in any modern browser. This surprised me a bit since it has always been possible with a simple little trick.

The problem

Say you have a website (site A) with an iframe wherein you host another website (site B). In old and unsecure browsers it was possible to do a JavaScript call from site B to site A like this:

window.parent.doSomething();

Here the doSomething function is living on site A and is called by site B through its parent window. For security reasons, this simple way of cross iframe communication was disabled years ago by all browser vendors.

The solution

There are different scenarios with possible solutions:

1: Site B is a sub domain under/beside Site A

Let’s say that:

  • Site A is located at example.com or sitea.example.com
  • Site B is located at siteb.example.com

All you need to do is to add this line of JavaScript to both site A and B:

document.domain = 'example.com'

That tells the browser that both site A and B belongs to the app located at example.com and are therefore allowed to communicate using JavaScript. It could be by calling window.parent.doSomething(); Now Same Origin Policy principle has been enabled on both sites.

2: Site B is on a different top domain than site A

This is more tricky, because we need to let the browser think both site A and B are under the same top domain.  When it does, we can implement the trick from solution 1 above.

Let’s say that:

  • Site A is located at example.com or sitea.example.com
  • Site B is located at foobar.com

To make this work, you need to create a sub domain called e.g. siteb.example.com. Then point the new sub domain to the IP address of foobar.com. Now both site A and B is located under example.com and you can start to implement solution 1.

There is no security risk going on here because you can only implement solution 1 if both site A and B participate in the trick.

Other solutions

If you can't use either solution 1 or 2 the game isn't over. Here are some other techniques to use:

Though not as simple as the document.domain trick, these are well documented and proven techniques.

Comments

Bertrand Le Roy
Might be worth checking out the OpenAjax Hub 2.0: http://www.openajax.org/member/wiki/OpenAjax_Hub_2.0_Specification
Bertrand Le Roy
Kazi Manzur Rashid
It is possible to communicate between frames even it is hosted in different domain. It is a bit of hack and requires proper implementation (depends on timer and # of the location). I did it long time ago you can find the details over here http://geekswithblogs.net/rashid/archive/2007/01/13/103518.aspx but I would never recommend it ;-).
Kazi Manzur Rashid
letstalkdev.com
Pingback from letstalkdev.com

Calling Remote JavaScript Through Iframes  @   Web Development Blog
letstalkdev.com
topsy.com
Pingback from topsy.com

Twitter Trackbacks for
         
        Iframe cross domain JavaScript calls 
        [madskristensen.net]
        on Topsy.com
topsy.com
Balaji
Very nice!  I've been wondering about frame cross domain JavaScript calls.  Do you have  any thoughts about JavaScriptMVC - Include?
Balaji
Mads Kristensen
I've heard about OpenAjax Hub before but then forgot about it. Thanks for the link
Mads Kristensen
markayi
the OpenAjax Hub 2.0 is really useful and working great for me
markayi
christian
I am surprised to know it is possible with standard security settings in any modern browser. Thanks for such a great salutation. it is very useful. 
christian
Satalaj
Hi,
 I have two frameset in my main page.  first frameset source set to my domain, second set to third party web 
say google. Now, end user do search in google and second frameset source would be another url. 

Can anyone tell me how can I notify the mainpage about what is the current url of second frame ? 

Thanks, Satalaj.
Satalaj
PimpThisBlog.com
Iframe cross domain JavaScript calls

Thank you for submitting this cool story - Trackback from PimpThisBlog.com
PimpThisBlog.com
random.cgi-biz.com
Pingback from random.cgi-biz.com

ARRAY -   Iframe cross domain JavaScript calls - Random Things To Blog
random.cgi-biz.com
Aroop
Hey bro...i'm sick n tired of searching a solution for my data entry application. Can you help me? The logic is i have a main page in that i have an iframe...in that i frame i am opening a website...www.irda.org...which has a form...what i want it fill the form from main page to the iframe form...thats all....i have tried all the tips n tricks but in vain.....please..please..help me...very critical for my job!!!!!!
Aroop
gineshkumar.wordpress.com
Pingback from gineshkumar.wordpress.com

Interesting Posts « Gineshkumar's Blog
gineshkumar.wordpress.com
devwebpro.com
Pingback from devwebpro.com

Calling Remote JavaScript Through Iframes | LetsTalkDev
devwebpro.com
momanimusic.allergiesaid.com
Pingback from momanimusic.allergiesaid.com

Iframe javascript | Momanimusic
momanimusic.allergiesaid.com
f23ko.com
Pingback from f23ko.com

javascript iframe 跨網域執行 « 二三往事
f23ko.com

Comments are closed