Hi, i want to host the yahoo open-id login in an iframe. However as soon as the yahoo page loads it executes the following javascript:
<script type="text/javascript">if(top == self)
{ document.write("") } else
{ top.location.href = "http://www.yahoo.com" }</script>
In other words, it redirects the whole page (not just the iframe). How can i prevent this redirect (all legal issues aside!)?
I don't think that's how you're supposed to properly implement it and that code is there for a reason. Have you gone through http://developer.yahoo.com/openid/ ?
Yahoo are absolutely right to stop you doing this; all OpenID providers should.
Putting OpenID in a frame means no visible address bar means no guarantee that the OpenID login form is actually coming from Yahoo; in fact, it looks like it's coming from your site. A user trying to avoid being phished should never enter their password into such a form. The whole point of OpenID is that it can guarantee your identity without making you give your password to every site you want to log in to.
So, no, you can't prevent it.