views:

78

answers:

2

I'm creating some IFrameable content. We want the user to be able to IFrame this page, but only from a set list of domains.

Is there anything that we can check to see what the domain name of the parent page is?

if (top != self) { top.location.replace(self.location.href); }
+2  A: 

No, the location of the parent page is not visible if that page is not in your security context (Same Origin Policy). You can of course look at the document.referrer of your own frame, but this isn't totally waterproof... referrer-checking on the client side is marginally less useless than on the server-side, but it can still be circumvented by something like a refresh-forwarder in the frame.

The frame-ancestors restriction in Content Security Policy may one day allow this.

bobince
+2  A: 

As bobince said, document.referrer looks to be your best bet. You would check this in the page that would be the src of the iFrame. However, HTTP referer information can be easily spoofed so this method isn't very secure.

This article shows how to do it using PHP: How to bypass the REFERER security check

sachleen
I'm going to bet most people aren't skilled enough to build an iframe into their site and have it pass a valid referer. The goal is to keep the general public from seeing the iframe in someone else's site. Thanks for the info.
PHP-Steven
That's what I figured, so in that case, `document.referrer` will get the job done.
sachleen