views:

42

answers:

4

Is it 100% impossible to get the browser URL from the iframe html of an iframe that is loaded onto a separate domain? I tried javascript and it did not work. What language could I do this in? Thanks!

UPDATE Thanks for the help! PHP does work.

<?php 
if(isset($_SERVER['HTTP_REFERER'])) 
{
    echo $_SERVER['HTTP_REFERER'];
}?>
+1  A: 

You can get the initial src property the iframe is set to.

 alert(document.getElementById("iframeID").src);

JSFiddle

however if the inlying document is navigated to another page, you are definitely not able to get the new address.

Pekka
Will this get the current URL (if the user has navigated within the frame) or the initial/default URL?
Christian Mann
what if you don't know the frame id because you aren't controlling the host page that is loading your site into an iframe? Thanks!
Angelfilm Entertainment
@Christian the initial one, added clarification. @Angelfilm no, you can't control the host page at all from within the iframe. The host URL *may* appear in the `HTTP_REFERER` request header, but you'll need server-side scripting to parse that
Pekka
Thanks for your help Pekka!
Angelfilm Entertainment
+1  A: 

If what you're asking is if you can get the URL of the browser that's hosting your page in an iframe through Javascript, the answer is no; you cannot do this in a properly-written web browser. If an iframe could spy on whatever is hosting it, then all kinds of malicious things could be done.

What you may be able to do is from your server-side code look at the referrer HTTP header in the request for your hosted page. That should be set to the URL of the page that's embedding your page.

Jacob
A: 

Once the user has navigated within that iframe which is in a different domain that the main document, you do not have access to any of the info about that new document within the iframe. This is to protect from XSS exploits and cannot be "worked around"

FatherStorm
A: 

Just use this JavaScript to detect if your page is inside an frame or iframe:

<script>
    if(top.frames.length > 0)
    {
       // do something like this to kill the iframe
       top.location = "http://mysite.com";
    }
</script>
charles.art.br
Angelfilm Entertainment