Search code examples
javascriptiframecross-domainsame-origin-policyscorm

SCORM: SecurityError: Blocked a frame with origin from accessing a cross-origin frame FOR SAME ORIGIN


I am aware there are plenty of similar questions, the only difference is I get this for two pages I serve from the **same ** domain. This can be seen in the example below.

    Uncaught DOMException: Blocked a frame with origin "https://content.samba.net" from accessing a cross-origin frame. 
  
at findAPI (https://content.samba.net/00/07/19-10/scorm_support/scorm_support.js:14:10)   
at getAPI (https://content.samba.net/00/07/19-10/scorm_support/scorm_support.js:61:13)   
at https://content.samba.net/00/07/19-10/SCORM.htm:200:16

Shouldn't this happen only between different domains?

============================== EDIT =======================================
Ofcourse, few seconds after I posted, I found the issue. The SCORM package has a function to locate the SCORM API. It looks at top and opener. In my case the Window Opener is in a different domain, It was trying to access that.
I'll leave it for history sake. My answer has the details.


Solution

  • The issue has been resolved, and it is specific to the SCORM protocol.
    When you open a piece of SCORM content, which is a bunch of html,flash,js and other media files, the first thing it does is trying to find the SCORM api.
    The SCORM api is JS that has to be in the window that loads the SCORM content.
    In some SCORM packages, the function that looks for the API, looks recursively for the TOP window, i.e. the initial window that started the entire process.
    In my case it was a window on my site, that poped the SCORM launcher on my CDN, which has a different domain name.

    All I had to do to solve this issue, is cheat the browser to think the SCORM launcher (the window I poped on the CDN) is the TOP, by adding the following two js lines in it:

    window.top=window;
    window.opener=window;