I have an HTML page (say wele.html) which contains an iframe to a page I have no control over (say app.html). The user performs some actions using the app within the iframe and clicks submit. Once they do this, they are taken to a new page (say thanks.jsp), which loads within the iframe. Is there a way in which I can force thanks.jsp to load in the full frame and not the iframe once submit is clicked? Remember, I have no control over the logic behind that Submit button or app.html. I do however have control over wele.html and thanks.jsp. If possible, I would like to stick with HTML and/or JavaScript. Thank you in advance.

I have an HTML page (say wele.html) which contains an iframe to a page I have no control over (say app.html). The user performs some actions using the app within the iframe and clicks submit. Once they do this, they are taken to a new page (say thanks.jsp), which loads within the iframe. Is there a way in which I can force thanks.jsp to load in the full frame and not the iframe once submit is clicked? Remember, I have no control over the logic behind that Submit button or app.html. I do however have control over wele.html and thanks.jsp. If possible, I would like to stick with HTML and/or JavaScript. Thank you in advance.

• javascript
• html
• iframe
• frame

2 Answers 2

You probably want to use a framebuster, with a base target in case it fails.

First:

If thanks.jsp is requested via a post request - redirect so it you present the page as the response to a get request.

Then:

Include framebuster JavaScript:

<script type="text/javascript">
   if (self != top) { top.location.replace(location); }
</script>

Finally:

In case the user doesn't have JavaScript enabled, make sure they don't stay in the frame any longer then they have to:

<base target="_top">

On thanks.jsp you can put in the following JS:

// Parent window not the same as this one
if (self !=top) 
{
    top.location.href = self.location.href;
} 

This will work provided that you have thanks.jsp on the same server as the original page containing the frame, due to the same origin policy.

The above code checks the url of the page you're on, then the one of the page it's executing on (thanks.jsp) - if they don't match you're sent to the thanks.jsp url. This method works fine when thanks.jsp is a static page, but won't carry postdata etc across with it.