XSS security. Communication between 2 iframes from the same domain.

Question

Domain abc.com has a page with 2 iframes. Both of them are loaded from domain xyz.com. Will XSS security block JavaScript access/communication/interaction between those two iframes?

Answer 1

Yes, because to obtain a reference to the document in the other frame, you must use the parent document.

var otherDocument = document.parent.frames[x].document;
// this will fail -----------^

Accessing sibling frames could also potentially allow you to determine what other domains the parent document has loaded, which could be construed as a vulnerability.

Answer 2

The iframes won't be able to get any content from the main page by javascript by the Same Origin Policy (SOP).

However they will be able to make POST(GET to some extents) calls to your server using your cookies (this is called CSRF). So don't rely only to session cookies for your security.

A good way to prevent this, is to have a token in your main page (invisible to the iframes) that you pass to every call to your server.

Answer 3

As Joel says, the Same Origin Policy will block access up to the parent window.

You can set up a communications channel between the client-side scripts on disparate documents/frames/windows from the same domain by using cookies. One document sets document.cookie to write a cookie, then the other, on an interval poller, reads document.cookie, finds something new in it, and treats that as a message.

It's really rather annoying, as you have to get each document to identify itself and signal when and to whom it's sending messages. Last resort method only, really.

Answer 4

Well, it depends on what you mean by communicate. It seems some type of communication is possible. Here is an example: HTML on www.abc.com:

<iframe name="test1" src="http://www.xyz.com/frame1.html"&gt;
<iframe name="test2" src="http://www.xyz.com/frame2.html"&gt;

Because the iframes are named we can do this in frame2:

<a href="javascript:alert(document.body.innerHTML)" target="test1">click me</a>

So we click the link in frame 2, but the contents of frame 1 is displayed.