Reputation: 18895
I have an external website that I'm using for payment processing. I'd like to create a modal dialog on the Lead Form that allows the user to process payment. I'm currently using Alert.js to create the modal, but it is failing to load with a Cross Site Scripting Error:
DOMException: Failed to read the 'contentDocument' property from 'HTMLIFrameElement': Blocked a frame with origin "https://MyCrmOnlineOrg.crm.dynamics.com" from accessing a cross-origin frame.
The interesting thing is I can actually debug the javascript on the external page (it gets downloaded and executes withing the F12 developer tools), but after I get the error, the "Loading" Gif never goes away...
I can get it to load correctly as an IFrame, as long as I uncheck the "Restrict cross-frame scripting, where supported" checkbox. Is there someway to do that for the Alert.js modal call? Is there a different way to do that?
Upvotes: 1
Views: 929
Reputation: 1470
An alternative to the Restrict tick box for XSS issues would be :
1 is good if your external site is a web service you could call from a JS web resource, which is not the case. 2 doesn't require a web service, it is cross-document messaging technique but it requires that you can edit the external's web site JS code, as it has to allow a request from your domain.
Upvotes: 1