Iframe and cross domain requests

Question

If I have a page served from foo.com which has an IFrame served from bar.com, then can a script inside the IFrame make an XMLHttpRequest to bar.com?

Also say that the IFrame from bar.com requests additional pages, then in the server, the referrer of these requests would point to bar.com or foo.com?

Answer 1

If your iframe is serving bar.com, then yes, the scripts in the iframe (bar.com) will be able to make an XMLHttpRequest to bar.com (same domain). If the iframe's page changes (unrelated to the XMLHttpRequest), the referer would be foo.com (the parent window).