Access parent URL from iframe
Okay, I have a page on and on this page I have an iframe. What I need to do is on the iframe page, find out what the URL of the main page is.
I have searched around and I know that this is not possible if my iframe page is on a different domain, as that is cross-site scripting. But everywhere I’ve read says that if the iframe page is on the same domain as the parent page, it should work if I do for instance:
… or other similar combos, as there seems to be multiple ways to get the same info.
Anyways, so here’s the problem. My iframe is on the same domain as the main page, but it is not on the same SUB domain. So for instance I have
and then my iframe URL is
When I try to grab the URL from pageB.html (the iframe page), I keep getting the same access denied error. So it appears that even sub-domains count as cross-site scripting, is that correct, or am I doing something wrong?
You’re correct. Subdomains are still considered separate domains when using iframes. It’s possible to pass messages using
postMessage(...), but other JS APIs are intentionally made inaccessible.
It’s also still possible to get the URL depending on the context. See other answers for more details.
Yes, accessing parent page’s URL is not allowed if the iframe and the main page are not in the same (sub)domain. However, if you just need the URL of the main page (i.e. the browser URL), you can try this:
var url = (window.location != window.parent.location) ? document.referrer : document.location.href;
window.parent.location is allowed; it avoids the security error in the OP, which is caused by accessing the
window.parent.location.href causes “Blocked a frame with origin…”
document.referrer refers to “the URI of the page that linked to this page.” This may not return the containing document if some other source is what determined the
iframe location, for example:
- Container iframe @ Domain 1
- Sends child iframe to Domain 2
- But in the child iframe… Domain 2 redirects to Domain 3 (i.e. for authentication, maybe SAML), and then Domain 3 directs back to Domain 2 (i.e. via form submission(), a standard SAML technique)
- For the child iframe the
document.referrerwill be Domain 3, not the containing Domain 1
document.location refers to “a Location object, which contains information about the URL of the document”; presumably the current document, that is, the iframe currently open. When
window.location === window.parent.location, then the iframe’s
href is the same as the containing parent’s
I just discovered a workaround for this problem that is so simple, and yet I haven’t found any discussions anywhere that mention it. It does require control of the parent frame.
In your iFrame, say you want this iframe: src=”http://www.example.com/mypage.php”
I found a great url string parser here:
If your iframe is from another domain, (cross domain), you will simply need to use this:
var currentUrl = document.referrer;
and – here you’ve got the main url!
For pages on the same domain and different subdomain, you can set the
Both the parent frame and the iframe need to set their document.domain to something that is common betweeen them.
api.foo.mydomain.com could each use either
foo.mydomain.com or just
mydomain.com and be compatible (no, you can’t set them both to
com, for security reasons…)
also, note that document.domain is a one way street. Consider running the following three statements in order:
// assume we're starting at www.foo.mydomain.com document.domain = "foo.mydomain.com" // works document.domain = "mydomain.com" // works document.domain = "foo.mydomain.com" // throws a security exception
Modern browsers can also use window.postMessage to talk across origins, but it won’t work in IE6.
The following line will work:
document.location.ancestorOrigins this one returns the ancestor domain name.