Search code examples
javascriptiframeframeset

can a page always refused to be iframed or be part of a frameset if javascript is enabled?

When a page is iframed or included as part of a frameset, it can use Javascript to check so. (i think usually by

if (self != top) top.location.href = self.location.href;

). Can the page always "jump back out" like that when Javascript is enabled? Is there a way to not let it jump back out? (suppose my page is iframing that page).

(in another scenario, i think if we use window.open() to open the page in a new windoe, then the page almost always cannot refuse... unless they check the referrer and actually refuse to serve the page even if it is a new, standalone window).

Solution

  • As far as I know, there is only one way - a Microsoft proprietary extension to HTML that allows an iframe start tag to specify that the page should be loaded with reduced security privileges - which usually blocks JS from running in it.

    Happily other browsers do not support this feature.