What exactly can an IFrame do with the top.Location object (cross-domain)?

javascript security iframe cross-domain window.location
Daniel Magliola picture Daniel Magliola · Jul 11, 2009 · Viewed 16.4k times · Source

There is a very particular edge case in cross-domain policies regarding the window.top.Location object...

Let's say I have IFrame A , in domain www.bbb.com, living inside a page in domain www.aaa.com.

The page inside the IFrame can:

  • Compare window.top.location to window.location (to detect whether it's being framed)
  • Call window.top.location.replace(window.location) to redirect to self
  • Call window.top.location.replace("any arbitrary string") to redirect somewhere else

But it cannot:

  • Alert, Document.Write, or do any kind of output of window.top.location.href
  • Concatenate it in any other variable, or use it in any useful way
  • Call window.top.location.reload()

These are just the ones I could quickly find. I'm sure there are other edge cases.
It seems like the browser is not allowing the use of the top.location object if the top is in another domain, except for a few whitelisted things...

Is this documented anywhere?
Can I find what these whitelisted things are?
Is this in the HTML standard, and implemented equally in all browsers? Or is the implementation of this semi-random?

Answer

molnarg picture molnarg · Oct 3, 2013

This is exactly specified by the HTML5 standard in section 5.5.3.1.

Related questions

SecurityError: Blocked a frame with origin from accessing a cross-origin frame

I am loading an <iframe> in my HTML page and trying to access the elements within it using Javascript, but when I try to execute my code, I get the following error: SecurityError: Blocked a frame with origin "…

Read More
To stop ClickJacking, which one is more secure? breaking out of iframe vs X-Frame-Options to Deny or Same Origin

To prevent clickjacking from happenning for your website, I have noticed several different methods. Some use javascript to have your website break out of iframe, the other soltution is to set the X-FRAME-OPTIONS header to DENY or SAMEORIGIN. Which one …

Read More
Why does Google prepend while(1); to their JSON responses?

Why does Google prepend while(1); to their (private) JSON responses? For example, here's a response while turning a calendar on and off in Google Calendar: while (1); [ ['u', [ ['smsSentFlag', 'false'], ['hideInvitations', 'false'], ['remindOnRespondedEventsOnly', 'true'], ['hideInvitations_remindOnRespondedEventsOnly', 'false_true'], ['Calendar ID stripped …

Read More