Allowing http iframe to call javascript on https parent frame

Question

I have an https page (https://example.com/main.php) that has an iframe with a non-https source (http://example.com/inner.php). Both files are on the same server - just one is accessed with https and the other is not. I need the non-https page to be able to execute javascript on the https main.php page using code such as parent.myfunction()

However, when I try this, I get the following error:

Unsafe JavaScript attempt to access frame with URL https://example.com/main.php from frame with url http://example.com/inner.php. Domains, protocols and ports must match.

I have set document.domain = 'example.com' on both files and I thought that would fix it, however, it does not. Is there any way to allow the frame to execute javascripts on the parent frame and vice-versa? If so, what are the security implications of this?

PS: For those of you that will suggest just using https or http for both pages, I am looking into that. However, due to the processes occuring in the iframe page, this might not be a a feasible option due to server load issues.

Answer 1

The "Same Origin Policy" covers the protocol ("http" or "https"), the hostname, and the port number. All of those have to match or you lose.

If your server load would really be affected by having to apply encryption to the <iframe> page, then I suspect you've got other, far more serious problems. In this day and age that really shouldn't be an issue. If you've got a massively high-traffic site, then you probably should be using a front-end to do the SSL anyway.

Answer 2

You can not do cross-domain/cross-protocol/cross-port access with JavaScript. This is known as "cross domain scripting", which is an issue since without security like this, I could open up GMail in an iframe, get the "u" and "p" textboxes, and have a user's login info like that.

What you put in your PS is the only real solution you can use besides using an echo server... which would be overkill.

Answer 3

If it were ever possible to do what you are asking to do, no SSL-secured web site would ever be safe.

Let me describe the problem. Let's say a user, Alice, goes to access her account on Paypal.com. I, Mallory, am between Paypal and Alice. As Alice accesses Paypal, I intercept her request and return a page containing two things: one frame with https://paypal.com, and one containing a page purporting to be 'http://my.paypal.com', which I crafted myself. The HTTPS frame validates fine because it actually came from Paypal. The HTTP frame contains some Javascript of my device which will reach into the HTTPS frame, and when Alice enters her password it will send it to me!

So no, it's not OK to access secure content from insecure content, even on the same domain.