Search code examples
javascripthtml

How can I allow document.domain on a sandboxed iframe?

I have a sandboxed iframe defined like so:

<iframe sandbox="allow-same-origin allow-scripts allow-popups allow-forms allow-modals" src="...">
</iframe>

When I set document.domain inside the iframe, I get the following error:

Uncaught DOMException: Failed to set the 'domain' property on 'Document': Assignment is forbidden for sandboxed iframes.

How can I allow document.domain to be set within the iframe?

Solution

  • (answering my own question thanks to comments)

    Since you are willing to set the document.domain to allow access between the two contexts, that defeats the purpose of the sandbox altogether. So, there is no point in sandboxing the iframe in the first place.