Access parent URL from iframe

user_412517 0
Viewed 341922

Okay, I have a page on and on this page I have an iframe. What I need to do is on the iframe page, find out what the URL of the main page is.

I have searched around and I know that this is not possible if my iframe page is on a different domain, as that is cross-site scripting. But everywhere I've read says that if the iframe page is on the same domain as the parent page, it should work if I do for instance:

parent.document.location

parent.window.document.location

parent.window.location

parent.document.location.href

... or other similar combos, as there seems to be multiple ways to get the same info.

Anyways, so here's the problem. My iframe is on the same domain as the main page, but it is not on the same SUB domain. So for instance I have

http:// www.mysite.com/pageA.html

and then my iframe URL is

http:// qa-www.mysite.com/pageB.html

When I try to grab the URL from pageB.html (the iframe page), I keep getting the same access denied error. So it appears that even sub-domains count as cross-site scripting, is that correct, or am I doing something wrong?

iframe cross-domain javascript
18 Answers

The following line will work: document.location.ancestorOrigins[0] this one returns the ancestor domain name.

user_102684820

Try it:

document.referrer

When you change you are in a iframe your host is "referrer".

user_95927450

There's a lot a answers to this question, and none of them are definitely the best in terms of support or reliability.

Options

  • window.location.ancestorOrigins[0] will get the parent url, but this api only works in chromium browsers (see support). this also supports nested iframes, where the bottom most child has access to the urls of each parent iframe.
  • document.referrer is the most common answer but is not always reliable

Things that don't work

  • window.parent.location.href. If the parent and the child are in different domains, this api is blocked by modern browsers (see here), and will throw an error.

Recommendation

If supported, I prefer window.location.ancestorOrigins[0]. document.referrer can work, but is less reliable, making it my fallback option. If you do use document referrer, try to call it on the first framed page load, before navigation or redirects, to get the parent address.

user_29327820

In chrome it is possible to use location.ancestorOrigins It will return all parent urls

user_27399000

there is a cross browser script for get parent origin:

private getParentOrigin() {
  const locationAreDisctint = (window.location !== window.parent.location);
  const parentOrigin = ((locationAreDisctint ? document.referrer : document.location) || "").toString();

  if (parentOrigin) {
    return new URL(parentOrigin).origin;
  }

  const currentLocation = document.location;

  if (currentLocation.ancestorOrigins && currentLocation.ancestorOrigins.length) {
    return currentLocation.ancestorOrigins[0];
  }

  return "";
}

This code, should work on Chrome and Firefox.

user_151509800

This worked for me to access the iframe src url.

window.document.URL
user_15036060

I know his is super old but it blows my mind no one recommended just passing cookies from one domain to the other. As you are using subdomains you can share cookies from a base domain to all subdomains just by setting cookies to the url .basedomain.com

Then you can share whatever data you need through the cookies.

user_5973900
Related