0

In my webapplication, I have a certain webpage that has an iframe inside of it with a certain source (can't tell which one, but I think (?) not really important for this question), but as soon as the webpage on my webapplication that contains the iframe in it is loaded, it throws a pop up which asks if I want to leave the page. I don't want this, I want to stay on the page with the iframe element inside of it.

The weird thing is, that when I for instance use http://example.org as the source (for testing), it shows the webpage normally without any pop up (and so did other pages I tested that contained HTML, CSS and most importantly JS).

What is it that causes this pop up? The pop up does not appear when I manually open the webpage that is included as the source of the iframe, in a browser.

2 Answers2

0

You get that message if the page you're trying to leave has added a listener for the beforeunload event.

The "certain webpage" may have code that's redirecting itself. Maybe it checks whether it's in an iframe and does this, so it only happens when you try to load that page in your iframe, not when you load it normally. It's hard to be more specific without knowing what the webpage is and how it's written.

Barmar
  • 741,623
  • 53
  • 500
  • 612
  • So you mean the page that *contains* the iframe or do you mean the page that is called inside the `iframe` itself? –  Jun 27 '19 at 11:59
  • Whichever page you're trying to leave. If you're replacing the contents of the iframe, it's the page that was in the iframe. – Barmar Jun 27 '19 at 12:02
  • Replacing the contents of the iframe? The only thing I want is show an external webpage inside an iframe. But the source that I am requesting causes this pop up (other pages I tested did not). So according to what you are saying is that this pop up is caused by the source of the iframe, which in this case probably has a listener for the `beforeunload` event? –  Jun 27 '19 at 12:05
  • I thought you were reassigning `iframe.src` with a new URL. So if the old URL has that listener, it will ask before you replace it. – Barmar Jun 27 '19 at 12:06
  • You wrote **I then use a different webpage**. I thought that meant that you were changing the webpage in the iframe. – Barmar Jun 27 '19 at 12:07
  • I changed the question, hopefully it is more clear now! –  Jun 27 '19 at 12:11
  • Whatever it is, it's specific to that webpage, so it *is* really important to the question. – Barmar Jun 27 '19 at 12:15
  • Hmm okay, I understand. The problem is that I can't just share the source code of the web page because it is kind off classified (not my code but the owner knows I'm working on this). My core question solely what it is that causes this kind of pop up, i.e. is it always the same function that causes such a pop up. –  Jun 27 '19 at 12:20
  • 1
    Yes, it's the `beforeunload` event. So look in the JS of that webpage to see where it does this. – Barmar Jun 27 '19 at 12:22
-1

There are serveral rules of iframe any page or website in your webpage. If it is not Same-origin it will allow you to iframe that website, if it is on different origin it will not allow you to iframe that webpage. For more information refer this link https://code.google.com/archive/p/browsersec/wikis/Part2.wiki#Origin_inheritance_rules

Bijal Patel
  • 210
  • 1
  • 3
  • 1
    What does this have to do with the "Do you really want to leave?" prompt that happens when you change the iframe contents? You seem to be answering a completely different question. – Barmar Jun 27 '19 at 12:03
  • @Bijal Patel so is it possible to by pass this? Or change the Same-origin policy? –  Jun 27 '19 at 12:16