I would like to create data on the user side and let javascript from another URL access it too. I am aware of the same origin policy, but I was wondering whether it is possible to create some exceptions. Or, is there any trick/feature I could use?

I would like to create data on the user side and let javascript from another URL access it too. I am aware of the same origin policy, but I was wondering whether it is possible to create some exceptions. Or, is there any trick/feature I could use?

• javascript
• html
• local-storage
• same-origin-policy

• Is the other URL embedded in an iframe? – louisbros Commented Apr 22, 2013 at 10:39
• No, it is not embedded. – Jérôme Verstrynge Commented Apr 22, 2013 at 10:41
• The only way I know of is if you are using localstorage in a browser extension or interframe. I'm not sure about IndexedDB though, I haven't played enough with that. – Xotic750 Commented Apr 22, 2013 at 10:49
• I don't think you can set any exceptions (maybe something like document.domain to circumvent SOP) - you can only load that other site and use cross-origin-messaging to pass the data – Bergi Commented Apr 22, 2013 at 11:18
• Does this answer your question? cross domain localstorage with javascript – Anderson Green Commented Jun 9, 2021 at 23:30

1 Answer 1

Best trick I know is to use iframes and postMessage API do get access to localStorage from external domain.

This technique is quite simple:

• on you page you must create iframe to a domain from which you want to get data

• your data domain need listen to message event:

  document.addEventListener ("message", handler, useCapture);

• handler will be responsible for accessing localStorage and posting its content to source domain

• your source domain may call handler function on data domain with postMessage API https://developer.mozilla.org/en-US/docs/DOM/window.postMessage

For security of your data you can use HTTP header X-Frame-Options ALLOW-FROM uri https://developer.mozilla.org/en-US/docs/HTTP/X-Frame-Options?redirectlocale=en-US&redirectslug=The_X-FRAME-OPTIONS_response_header

Hope it will help.