Search code examples
phpjavascriptiframewhitelist

Howto Prevent IFraming w/ Whitelist


I'm creating some IFrameable content. We want the user to be able to IFrame this page, but only from a set list of domains.

Is there anything that we can check to see what the domain name of the parent page is?

if (top != self) { top.location.replace(self.location.href); }

Solution

  • No, the location of the parent page is not visible if that page is not in your security context (Same Origin Policy). You can of course look at the document.referrer of your own frame, but this isn't totally waterproof... referrer-checking on the client side is marginally less useless than on the server-side, but it can still be circumvented by something like a refresh-forwarder in the frame.

    The frame-ancestors restriction in Content Security Policy may one day allow this.