I am trying to access a function located on the parent page from an iframe. I get the following error since they're using different sub-domains:

Uncaught SecurityError: Blocked a frame with origin "" from accessing a frame with origin "". Protocols, domains, and ports must match.

I am using:

window.parent.myFunction(); 

to access the function on the parent page.

Is there a workaround for this or will it simply not work because they're different sub-domains?

I am trying to access a function located on the parent page from an iframe. I get the following error since they're using different sub-domains:

Uncaught SecurityError: Blocked a frame with origin "http://subdomain.domain." from accessing a frame with origin "http://subdomain2.domain.". Protocols, domains, and ports must match.

I am using:

window.parent.myFunction(); 

to access the function on the parent page.

Is there a workaround for this or will it simply not work because they're different sub-domains?

• javascript
• jquery
• security
• iframe

4 Answers 4

Blocked a frame with origin "http://subdomain.domain." from accessing a frame with origin "http://subdomain2.domain."

If you add the line:

document.domain = 'domain.';

to the scripts in both frames, they will be able to interact directly with each other's objects. See MDN for background.

However cross-frame scripting is strewn with nasty corner cases, where one frame executes something from another frame whilst that frame is busy doing something else, or isn't yet fully loaded. For anything non-trivial, I would avoid direct cross-frame scripting.

The more modern alternative is to keep execution within a single frame, and municate across frames using postMessage. Support.

This will only works if you have access to the parent domain (e.g. upload files there).

Inside your iframe page, create a second iframe with a source pointing to a page in the main domain.

The second iframe can call a function in the main page by using window.parent.parent.myFunction();

No, this is a security issue and you will not find a way around it.

I have heard that you can use jsonp for getting info from another domain but I have never tried it.

You cannot make the parent do anything though