How to apply css to IFrame with CORS enabled

Question

A subdomain http://board.woodstockschool.in will display a content within Iframe from my.woodstock.ac.in.

In the HTTP headers from my.woodstock.acin it does have this entry:

Access-Control-Allow-Origin => http://board.woodstockschool.in

But I'm unable to change the content look using CSS from the board.woodstockschool.in website.

I've tried these as well:

a ,iframe a{
color: red !important;
}

This changes color of all links except for in the Iframe.

There is an array of questions like How to apply style to a div which is inside an iframe of the page? in here but none with CORS enabled.

What is the way to apply the css rule from the wrapper site without using any javascript?

Possible duplicate of [How to style inside an iframe from an external domain?](http://stackoverflow.com/questions/23873407/how-to-style-inside-an-iframe-from-an-external-domain) — Steve, Oct 17 '16 at 06:47

score 1 · Answer 1 · answered Oct 17 '16 at 06:47

What is the way to apply the css rule from the wrapper site

There is no way.

The closest you could come would be to:

Set a query string on the iframe's src and then have the embedded page use server side code to stick a <link> to the stylesheet in based on that.
Use postMessage to send a message (possibly including the URL of the stylesheet) to the embedded page and then have JavaScript running on the embedded page add the <link>.

CORS will not help or hinder you in this. It's entirely irrelevant.

@Kaiido — No, it doesn't. "CORS will not help or hinder you in this. It's entirely irrelevant." — Quentin, Oct 17 '16 at 06:52

T.Todua · Answer 2 · 2016-10-17T20:25:20.170

0

The best way may be the following (in case you control both sites):

1) set the iframe link with style parameter, like:

http://your_site.com/target.php?style=a%7Bcolor%3Ared%7D

(the last phrase is a{color:red} encoded by urlencode function)

2) set the receiver page target.php like this:

<head>
..........
<style><?php echo filter_var($_GET['style'], FILTER_SANITIZE_STRING);?> </style>
..........

edited Oct 17 '16 at 20:25

answered Oct 17 '16 at 08:00

T.Todua

1

**Danger**: This code is [vulnerable to XSS](https://www.owasp.org/index.php/XSS) User input needs escaping before being inserted into an HTML document!. – Quentin Oct 17 '16 at 08:03
1

`urldecode` attempts to double decode the data. PHP will decode it automatically before populating `$_GET`. – Quentin Oct 17 '16 at 08:03
yes, thanks @Quentin , i have modified the answer to reflect your advise. – T.Todua Oct 17 '16 at 20:22

2 Answers2