Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm working on a glorified click-jacker which uses CNAMES for navigation (example.bit -> example.speech.is) and I want to allow cross-domain access to the contents of an iFrame. The child iframe has headers set to:

Access-Control-Allow-Origin: *
Content-Security-Policy: default-src 'self' 'unsafe-inline' *.speech.is http://bits.speech.is https://bits.speech.is http://speech.is

But I am still unable to access the iframe using iframe.windowContent.document (actually it's speech.windowContent.document). Firefox gives me:

Error: Permission denied to access property 'document'

While Chrome reports:

SecurityError: Blocked a frame with origin "http://bits.speech.is" from accessing a frame with origin "http://208.113.212.187". Protocols, domains, and ports must match.
code: 18
message: "Blocked a frame with origin "http://bits.speech.is" from accessing a frame with origin "http://208.113.212.187". Protocols, domains, and ports must match."
name: "SecurityError"
stack: "Error: Blocked a frame with origin "http://bits.speech.is" from accessing a frame with origin "http://208.113.212.187". Protocols, domains, and ports must match.↵    at <anonymous>:2:21↵    at Object.InjectedScript._evaluateOn (<anonymous>:580:39)↵    at Object.InjectedScript._evaluateAndWrap (<anonymous>:539:52)↵    at Object.InjectedScript.evaluate (<anonymous>:458:21)"

Is there anyway to trace where this security policy is getting set?

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

Access-Control-Allow-Origin:* allows certain CORS requests from XHR, but does not allow direct JS acces through the iframe. If you want to use communicate with the iframe you could use postMessage instead, and implement listeners in both the iframe and the parent. Of course you then need to control the page shown in the iframe.

share|improve this answer
    
I know about postMessage, but I was told that this was possible. Is this only any issue for parent->child or is child->parent manipulation possible? –  Indolering Nov 6 '13 at 0:18
1  
@Indolering The linked answer states "an iFrame cannot read the contents of another iFrame unless they are on the same domain." –  SilverlightFox Nov 6 '13 at 9:56
    
Thanks for pointing that out Silverlight. I think there was a communication error in a later exchange. –  Indolering Nov 7 '13 at 3:04
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.