Path: csiph.com!x330-a1.tempe.blueboxinc.net!usenet.pasdenom.info!aioe.org!eternal-september.org!feeder.eternal-september.org!mx04.eternal-september.org!.POSTED!not-for-mail From: Arno Welzel Newsgroups: comp.lang.javascript Subject: Re: cross-scripting issue: use javascript/DOM on iframe loaded from different domain, how? Date: Tue, 20 Dec 2011 10:14:36 +0100 Organization: A noiseless patient Spider Lines: 31 Message-ID: <4EF051FC.1010803@arnowelzel.de> References: Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Injection-Info: mx04.eternal-september.org; posting-host="dd4uQGf4fHOQcq7/hg1u1Q"; logging-data="32284"; mail-complaints-to="abuse@eternal-september.org"; posting-account="U2FsdGVkX1+b6mbcC3Fs8P6aCRCFYGYHhS2vcb+Ev+U=" User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20111105 Thunderbird/8.0 In-Reply-To: Cancel-Lock: sha1:7OexCHT5xK8F+04M7B0xM6tthN8= Xref: x330-a1.tempe.blueboxinc.net comp.lang.javascript:9445 Mike S, 2011-12-20 02:44: > I have a page that contains an iframe which loads a page from a > different domain that I do not control. The iframe includes the > following select: > > > > I would like to be able to select AAA using javascript on the parent > page. I can work with the people who maintain the site that hosts the > page loaded into the iframe, so I'm wondering if there is some way that > they cold modify their page that would allow me to execute javascript on > it from my parent page? Would including window.domain="mydomain.ext" in > the iframe page, where mydomain.ext is the domain hosting the parent > page, allow me to access the iframe DOM with javascript? No - because the same origin policy will always apply and forbid cross domain script access (and if not, this would be a security flaw!). One solution: Do not load the page directly from the remote server but with a script within your own domain (e.g. using PHP with cUrl). -- Arno Welzel http://arnowelzel.de http://de-rec-fahrrad.de