CODEWITHSUNDEEP
javascriptiframeframe
Singuan Iap
Singuan Iap

Reputation: 31

How to identify a webpage is loaded inside an IFRAME or a FRAME

I am developing a "content script" of Chrome Extension. It has to activate some javascript functions if the page is loaded in a <FRAME> but no in an <IFRAME>.

I know that I can check window.frameElement by

var inIFrame = (window.frameElement.tagName=='IFRAME')

But it failed if the child frame is not in the same domain with the parent frame. It throws cross-domain security warning. How the child frame knows it is in IFRAME or FRAME without violating the security policy?

Upvotes: 1

Views: 222

Answers (1)

Niels Keurentjes
Niels Keurentjes

Reputation: 41968

No, this is impossible to determine. The child document cannot cross its security boundaries, and if the domain is different and no other CORS permissions are in place its 'visible world' is limited to the scope of its own document, ie its own window. There is no way to look beyond that into the parent document's scope, and determine the type of the containing element. Doing so would expose the entire object and its attributes, including all potential exploits of that knowledge.

Upvotes: 1

Related Questions