6

I'm trying to store a value on another domain using an iframe (actually, I'm using the xauth library at http://xauth.org/info/). However, when I try to store anything using Chrome, it comes back with "QUOTA_EXCEEDED_ERR: DOM Exception 22", which I've come to recognize as an access error. I've mocked up a couple of very simple pages below to duplicate the effect:

File 1.html:

<html>
<head/>
<iframe src='http://127.0.0.1/2.html' />
</html>

File 2.html:

<html>
<head/>
<script>
console.log(localStorage);
localStorage.setItem('test', '123');
</script>
</html>

If I place both of these on my local server and access localhost/1.html it embeds a frame from 127.0.0.1 (which Chrome considers a separate domain), and I get the same access error as above. At a guess, it looks like even though I'm embedding an iframe from another domain, and the script inside that iframe references the localStorage for that domain properly (as I can see with the console.log(localStorage) line), the permissions for writing to localStorage are coming from the top page's domain.

In short, it looks like no iframe can write to localStorage in Chrome. Does anybody know if there's a way around this particular security "feature"? Or am I doing something wrong?

Chris
  • 405
  • 2
  • 5
  • 13
  • Note I've also checked my localStorage objects for both localhost and 127.0.0.1 and guaranteed that they're empty, so I know for a fact that the "Quota exceeded" error really is erroneous; I certainly haven't exceeded the 5MB quota. – Chris May 25 '12 at 22:39
  • did you solve this? I'm getting the same issue – Lloyd Oct 01 '12 at 16:48
  • Use postMessage... https://stackoverflow.com/questions/40461120/using-postmessage-isnt-being-received – Zvi Redler Aug 07 '19 at 13:37
  • As Zvi Redler said, have you tried using HTML5 postMessage to communicate between your two origins using an IFRAME? You'll need a listener and a call to postMessage. Please let us know what you find out. – StephenKC Jan 19 '21 at 19:45

3 Answers3

5

The problem only occurs when third-party cookies are disabled. Newer versions of Firefox and Opera are also blocking it. In IE and Edge it is still possible although third-party cookies are disabled. If the localStorage would not be blocked in the iframe, a web tracker could simply include a iframe, read the cookie, send it to the parent script, and then send it to the server.

The reason why this is not blocked in IE and Edge is that these browser allow websites to send third-party cookies, which were previously set as first-party cookies, to the server although third-party cookies are blocked. For example, if a user visits facebook on a regular basis, he gets first-party cookies from facebook. When he then visits other websites with facebook's share button, facebook can track him although third-party cookies are disabled. I really do not know why IE and Edge do not block third-party cookie sending, but I would not use these browsers anyway.

The errors the browsers show when third-party cookies are disabled:

Chrome and Opera: Uncaught DOMException: Failed to read the 'localStorage' property from 'Window': Access is denied for this document.

Firefox: SecurityError: The operation is insecure.

IE and Edge: No error, access to localStorage in iframe is possible although third-party cookies are disabled.

So in conclusion, it is not possible to bypass this security feature (in Chrome, Firefox, Opera) and this is good in order to ensure users' privacy.

maxeh
  • 1,373
  • 1
  • 15
  • 24
2

This is an old post, but if someone else see it- you can use postMessage

https://stackoverflow.com/a/40469196/4836581

Zvi Redler
  • 1,708
  • 1
  • 18
  • 29
1

Well, localStorage is domain-based and there is no reason for your example code to fail. What it actually does is to set the test item to 123 for 127.0.0.1 whereas it will leave the localhost localStorage empty.

This might not be the answer to your initial problem of QUOTA_EXCEEDED_ERR, but just try to switch to private browsing on Chrome (Ctrl+Shift+N) to see if you still have the error. Without further information on what you were initially doing, I can't tell much but I believe that quota exceeded means what it means...

And I think Chrome's quota is 2.5mb unlike FF which has 5mb of localStorage quota.

mmg666
  • 353
  • 1
  • 12
  • Even in incognito mode I'm getting the same error. Even if Chrome's quota is 2.5MB, there's still no way I'm even close to that. – Chris Jun 02 '12 at 00:30
  • Also, the issue is that while the script should be setting the "test" item to value "123", it doesn't; it throws the error instead. – Chris Jun 02 '12 at 00:32
  • I had tested your code on Chrome without any issues, were you able to find out what was going on with your code? – mmg666 Jun 11 '12 at 22:03