0

I want to allow an iframe to request new data from the server (via ajax), only if the iframe is embedded in particular pages. How can I get the top level domain within an iframe?

At first I was thinking security would be easy, on my server I can simply check the http_referrer which is a standard thing sent with every HTTP request.

But then I realized this http_referrer is actually the domain of my iframe, not the domain that contains the iframe! So if I embedded my_iframe.com in my_site.com, the http_referrer is my_iframe.com, which doesn't help me know who is embedding the page.

So now I'm pursuing this alternative.

Don P
  • 60,113
  • 114
  • 300
  • 432
  • 1
    Answer was just to do `document.referrer` from the iframe. That gives the containing window regardless of whether it's the same origin. – Don P Apr 24 '14 at 18:19

2 Answers2

1

You could use window.top to access the top most window and the use the normal location object, however you will run into issues regarding the same origin policy if trying to access an external domain from within your iframe, i suggest you check this community post about the same-origin policy.

window.top.location.href
window.top.location.host
Community
  • 1
  • 1
Kyle Needham
  • 3,379
  • 2
  • 24
  • 38
0
try {
    alert(window.top.location.origin);
} catch(e) {
    console.log(e.message);
}
Ryan
  • 14,392
  • 8
  • 62
  • 102