Iframe pointing at local page is empty and inaccessible

Question

This is a strange one as up until very recently this functionality was working fine and is still working on a different site.

I'm using an iframe to allow users to initiate downloads on a page without having to submit the actual page itself using asp.net:

<iframe id="ifrDownload" name="ifrDownload"  scrolling="no" frameborder="0" marginwidth="0" marginheight="0" style="display: none;" src="Download.aspx"></iframe>

However recently when attempting the download I get the infamous "Permission denied to access property 'document' error when accessing the iframe, obviously the local file is on the same domain as the parent so I'm not sure why that's happening, but I'm sure it's related to the odd thing that happens when I inspect the page in Firebug.

The site that works without any problems displays the following for the iframe when inspected:

<iframe id="ifrDownload" scrolling="no" frameborder="0" src="Download.aspx"  style="display: none;" marginheight="0" marginwidth="0">

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title> </title>
</head>
<body>
<form id="downloadForm" action="Download.aspx" method="post" name="downloadForm">
<div>
<input id="__VIEWSTATE" type="hidden" value="/wEPDwULLTExNjE3Nzc3MzlkZMnbcG6xJn5Jp/GA7fqNd/QyKuTC" name="__VIEWSTATE">
</div>
<div>
<input id="__EVENTVALIDATION" type="hidden" value="/wEWBgLTi7KCAQLnqqEBAuXC+6cLAoPKgZYKAvWdu+YGApj5qL4FFEFbauoxzxy+93iYHGZSO7dPLso=" name="__EVENTVALIDATION">
</div>

<div>
<input id="downloadButton" type="submit" style="display: none;" value="Confirm Download" name="downloadButton">
<input id="attachmentIdField" type="hidden" name="attachmentIdField">
<input id="tableFieldId" type="hidden" name="tableFieldId">
<input id="filenameField" type="hidden" name="filenameField">
<input id="whichField" type="hidden" name="whichField">
</div>

</form>
</body>
</html>
</iframe>

But the non-working site simply shows:

<iframe id="ifrDownload" scrolling="no" frameborder="0" src="Download.aspx" style="display: none;" marginheight="0" marginwidth="0" name="ifrDownload">
<html>
<head></head>
<body></body>
</html>
</iframe>

The Download.aspx file is pretty much identical for both sites and is in the same directory as the parent page for both, I can only think I've inadvertently put some code somewhere that's breaking the way the iframe works.

Any suggestions? I've Linted the HTML and all seems fine.

score 0 · Accepted Answer · answered Mar 07 '12 at 11:08

Ok, after much, much searching; I found the following in a Global.asax file:

void Application_BeginRequest(object sender, EventArgs e) {
    HttpContext.Current.Response.AddHeader("X-Frame-Options", "DENY");
}

Which disabled all cross frame options effectively disabling all iframes linking to aspx pages, but not html pages.

Removing this code which was put in, apparently to stop cross site scripting, fixes the problem.

Iframe pointing at local page is empty and inaccessible

1 Answers1