為了改善您的使用體驗，本網站正在進行維護，部分功能暫時無法使用。若本站的文件無法解決您的問題，想要向社群發問的話，請到 Twitter 上的 @FirefoxSupport 或 Reddit 上的 /r/firefox 發問，我們的社群成員將很快會回覆您的疑問。

Avatar for Username

搜尋 Mozilla 技術支援網站

防止技術支援詐騙。我們絕對不會要求您撥打電話或發送簡訊，或是提供個人資訊。請用「回報濫用」功能回報可疑的行為。

了解更多

此討論串已被封存。 如果您有需要幫助，請新增一個新問題

Cross-Origin Resource Sharing. Added header 'Access-Control-Allow-Origin' in response header for iframe data. Can parent page now manipulate iframe's DOM ?

  • 1 回覆
  • 2 有這個問題
  • 1 次檢視
  • 最近回覆由 guigs

binit.00354
binit.00354
more options

Let say, I have a page on domain www.a.b.xyz.com. This page contains an iframe, with data from www.d.xyz.com.

iframe is loaded with data from www.d.xyz.com, by submitting html form to host www.d.xyz.com. In return server www.d.xyz.com is returning HTML DOM to be rendered in iframe. Server also sets header 'Access-Control-Allow-Origin: *.xyz.com' in response.

iframe is loaded with HTML DOM from www.d.xyz.com.

Now, I'm trying to access/manipulate (for eg: Click a button in iframe) DOM from parent page using Javascript. But, I'm not able to do so.

Is it because, 'Access-Control-Allow-Origin: *.xyz.com' just informs browser to show/render the content from www.d.xyz.com on www.a.b.xyz.com, but do not grant permission to parent page to manipulate iframe's DOM ?

I am able to manipulate iframe's DOM from parent, only if I create sub-domain for both parent and iframe- document.domain='xyz.com'; I changed domain using firebug debugger.

Any help will be appreciated.

Let say, I have a page on domain www.a.b.xyz.com. This page contains an iframe, with data from www.d.xyz.com. iframe is loaded with data from www.d.xyz.com, by submitting html form to host www.d.xyz.com. In return server www.d.xyz.com is returning HTML DOM to be rendered in iframe. Server also sets header 'Access-Control-Allow-Origin: *.xyz.com' in response. iframe is loaded with HTML DOM from www.d.xyz.com. Now, I'm trying to access/manipulate (for eg: Click a button in iframe) DOM from parent page using Javascript. But, I'm not able to do so. Is it because, 'Access-Control-Allow-Origin: *.xyz.com' just informs browser to show/render the content from www.d.xyz.com on www.a.b.xyz.com, but do not grant permission to parent page to manipulate iframe's DOM ? I am able to manipulate iframe's DOM from parent, only if I create sub-domain for both parent and iframe- document.domain='xyz.com'; I changed domain using firebug debugger. Any help will be appreciated.

由 binit.00354 於 修改

所有回覆 (1)

guigs
guigs
more options

It sounds like you are running into this restriction and are looking for a work around: security.fileuri.strict_origin_policy preference, which defaults to true

I am not entirely sure if the subdomain counts a the same origin, but you can try location set. But an even better example: https://developer.mozilla.org/en-US/A.../Cross_Domain_Content_Scripts#Cross-domain_iframes

So your original question: Can parent page now manipulate iframe's DOM ? Sort of.


References: