I was wondering if there's a way to add html to a webpage (from another domain) before displaying it in a iframe. Basically my idea is to make a website that allows the user to type in a website and choose or add things to the page, like copy a yahoo anwsers page and still have it function (so javascript and all still works) but the background has changed or a button that does a specific thing to the page has been added in. So far I keep running into cross domain policies and I have no idea how to get round these.
Asked
Active
Viewed 78 times
-3
-
4No, you cannot do this because of the cross domain policies you've already encountered. If there was a way around them they'd be pointless. – Rory McCrossan Nov 27 '17 at 13:36
-
btw this would break copyright-laws and is therefor illegal. – Nikolaus Nov 27 '17 at 14:20
-
Possible duplicate of [Cross domain iframe issue](https://stackoverflow.com/questions/9393532/cross-domain-iframe-issue) – Dmitry Nov 27 '17 at 14:44
2 Answers
1
No, you cannot, this will be a massive violation of information security codes.
Imagine if someone could access your code, js and html and just alter it and access your information.
even worse, if you have sensitive information stored in the client code (you shouldn't but lets imagine), everyone across the web will have access to that information.
Displaying the webpage is one thing, you have api's for this sort of things (for example, google, twitter, facebook api's) and you pay for them too.
The reason you are running into cross domain policies is because you are not allowed to make that request. Not by JsonP and not by CORS Requests.
If you want access, look for a proper api.
For beginners, here is the Yahoo Api (Yql)
And here is it's Terms of use
Read them before you continue.
Barr J
- 10,636
- 1
- 28
- 46
0
You can't do that because, if you could, an attacker could use this to exploit referred page.
Source: https://developer.mozilla.org/pt-BR/docs/Glossary/Cross-site_scripting
Marco
- 2,757
- 1
- 19
- 24