Cross-Domain Iframe source--how is is checked?

[jsteph]

I understand that one can't have an Iframe's source from a different domain as the parent page. My question is--is this checked against the URL or does the checking mechanism first resolve down to the IP address and check that?

For instance, on an intranet, would an iframe source of:

http://servername.companyname.com/someasppage.asp

be ok if the user was on the main page of:

http://servername/mainpage.asp

(assuming companyname.com is the fully qualified path of 'servername')

Thanks,
--Jim

 

[BillyRayPreachersSon]

You might try looking into the document.domain property if you need to get a workaround for any domain issues.

Hope this helps,
Dan



[tt]Dan's Page [blue]@[/blue] Code Couch

http://www.codecouch.com/dan/

[/tt]

 

[trollacious]

Are you saying that a page with a different domain name can't load into an iframe? I just checked a site where I used that and the page works fine. It's a real estate agent's site where a search feature is hosted with a completely different domain, and it's loaded in an iframe on her site.

Lee

 

[jsteph]

I'm not sure I've got the terminoligy right, but I'd always heard that it was built into the lowest level of the 'specs' for html, or browsers, or whatever, that you couldn't have the .source of an Iframe be anything not on the same domain.

I know that there's some setting in IE Security preferences that says 'Access data sources across domains'. I'm not sure if that's the same thing.

Anyway, the bottom line is that I changed a bunch of peoples shortcuts for one of our intranet websites to include the fully qualified server.domain/page. Now some of them--not all--get the 'Error On Page', and the details say 'Permission Denied'. The line # referenced is an xmlhttp object's Get method in javascript, which has a url as an argument. The url is in the same domain, but does not have the fully qualified name, though it always worked fine before.
--Jim

 

[trollacious]

As far as I know (limited experience writing pages with that, but I've seen a few dozen like that on other sites), you can pretty much use any URL in a frame whether it's in the top domain or not. It could well be that a security setting in the browser would limit that. What I referred to uses a src="" in the frame tag, not AJAX to get the frame contents.

Lee

 

[Diancecht]

You can have an iframe showing the contents of a page from another domain, but you cannot programatically access those contents.

Cheers,
Dian