Same origin Issue with iframe loaded from AWS S3

Question

I just changed my blog from wordpress to django-zinnia. Zinnia uses a WYMeditor (https://github.com/wymeditor/wymeditor) iframe within django-admin for blog post text and content entry, and right now I can't access the iframe due to a same-origin issue. The error I'm seeing in browser console is:

Blocked a frame with origin "http://www.mydomain.com" from accessing a frame with origin "http://mybucket.s3.amazonaws.com". 
Protocols, domains, and ports must match.
WYMeditor.WymClassSafari.initIframe 
onload

Is there a parameter I can update in my CORS configurations for the bucket to allow the iframe to load cross-origin? I already have

 <AllowedOrigin>http://www.mydomain.com</AllowedOrigin>

within my current CORS rules:

<?xml version="1.0" encoding="UTF-8"?>
    <CORSConfiguration xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
         <CORSRule>
             <AllowedOrigin>http://mydomain.herokuapp.com</AllowedOrigin>
             <AllowedOrigin>http://mydomain.com</AllowedOrigin>
             <AllowedOrigin>http://www.mydomain.com</AllowedOrigin>
             <AllowedMethod>GET</AllowedMethod>
             <MaxAgeSeconds>3000</MaxAgeSeconds>
             <AllowedHeader>Content-*</AllowedHeader>
             <AllowedHeader>Host</AllowedHeader>
             <AllowedHeader>Authorization</AllowedHeader>
        </CORSRule>
   </CORSConfiguration>

I'm fairly certain that CORS files do not affect iframes. – datasage Sep 22 '13 at 19:14 — datasage, Sep 22 '13 at 19:14

score 5 · Accepted Answer · edited May 23 '17 at 10:31

5

The CORS headers do not affect the same-origin policy for iframes in Safari.

You can communicate between the frames using postMessage or you could attach a subdomain from mydomain.com to your S3 bucket and relax the same-origin policy by setting document.domain (this method only works to communicate between subdomains of the same domain, it doesn't work between different domains).

You can learn more about iframes communication from this answer on StackOverflow:

Ways to circumvent the same-origin policy

edited May 23 '17 at 10:31

Community

1
1

answered Sep 22 '13 at 19:30

dcro

13,294
4
66
75

thanks. very helpful. based on this document.domain with a subdomain is probably the best route. alternatively -- at least in my case since this only affects a template in admin, not any user-facing pages so I don't care about page performance/load time -- I could also just do a bad hack-around and insert the wymeditor js directly into the page from the template itself to solve my issue – Chris B. Sep 22 '13 at 21:57

Same origin Issue with iframe loaded from AWS S3

1 Answers1