5

It is possible for a iframe to redirect the page it is on?

Example:

You go to www.fuu.com

On fuu.com there is a iframe

In that iframe is a website the redirects to another website.

Is it possible for fuu.com to be redirected? instead on just the iframe going to another page?

user2864740
  • 60,010
  • 15
  • 145
  • 220
john martin
  • 61
  • 1
  • 1
  • 2
  • What do you mean by redirected? But I'm pretty sure the answer is yes. – joshhunt Aug 06 '14 at 23:07
  • Something like `window.top.location.href = "http://example.com";` or `parent.document.location.href = "http://example.com";` – Funk Forty Niner Aug 06 '14 at 23:07
  • Oh, you mean you want the iframe to redirect the "parent" page? In that case no thats not possible. Edit: Actually I think I am wrong, see: http://stackoverflow.com/questions/580669/redirect-parent-window-from-an-iframe-action-using-javascript – joshhunt Aug 06 '14 at 23:09

1 Answers1

5

No. An iframe is treated as a separate document with its own DOM. A redirect within the iframe is treated as a redirect only within that iframe.

In other words, The main page can not be redirected by an iframe.

EDIT: I was wrong. Consider the following situation

Top Page

<html>
<body>
<iframe src="redirect.html"></iframe>
</body>
</html>

redirect.html

<html>
    <head>
        <script>
            window.top.location = "http://www.w3schools.com";
        </script>
    </head>
</html>

That does redirect the top page to w3schools.com

To prevent this type of thing, you can remove that by using the following

<html>
<body>
<iframe src="redirect.html" sandbox="allow-scripts"></iframe>
</body>
</html>

In chrome, this would give you the following error: 

Unsafe JavaScript attempt to initiate navigation for frame with URL 'http://127.0.0.1/scg/?search=&submit=Search' from frame with URL 'http://127.0.0.1/scg/iframeRedirect.html'. The frame attempting navigation of the top-level window is sandboxed, but the 'allow-top-navigation' flag is not set.

The allow-scripts allows Javascript to still be executed in the iframe but removes window.top from allowing to execute. Check this out

Mic1780
  • 1,774
  • 9
  • 23