从 iframe 访问父 URL [英] Access parent URL from iframe

问题描述

好的，我有一个页面，在这个页面上我有一个 iframe.我需要做的是在iframe页面上，找出主页的URL是什么.

Okay, I have a page on and on this page I have an iframe. What I need to do is on the iframe page, find out what the URL of the main page is.

我四处搜索，我知道如果我的 iframe 页面位于不同的域中，这是不可能的，因为这是跨站点脚本.但是我读过的所有地方都说，如果 iframe 页面与父页面在同一个域中，那么它应该可以工作，例如:

I have searched around and I know that this is not possible if my iframe page is on a different domain, as that is cross-site scripting. But everywhere I've read says that if the iframe page is on the same domain as the parent page, it should work if I do for instance:

parent.document.location

parent.window.document.location

parent.window.location

parent.document.location.href

... 或其他类似的组合，因为似乎有多种方法可以获得相同的信息.

... or other similar combos, as there seems to be multiple ways to get the same info.

无论如何，问题来了.我的 iframe 与主页在同一个域中，但不在同一个 SUB 域中.所以例如我有

Anyways, so here's the problem. My iframe is on the same domain as the main page, but it is not on the same SUB domain. So for instance I have

http://www.mysite.com/pageA.html

http:// www.mysite.com/pageA.html

然后我的 iframe URL 是

and then my iframe URL is

http://qa-www.mysite.com/pageB.html

http:// qa-www.mysite.com/pageB.html

当我尝试从 pageB.html(iframe 页面)获取 URL 时，我不断收到相同的访问被拒绝错误.所以似乎子域也算作跨站点脚本，这是正确的，还是我做错了什么?

When I try to grab the URL from pageB.html (the iframe page), I keep getting the same access denied error. So it appears that even sub-domains count as cross-site scripting, is that correct, or am I doing something wrong?

推荐答案

你说得对.使用 iframe 时，子域仍被视为单独的域.可以使用 postMessage(...) 传递消息，但故意将其他 JS API 设置为不可访问.

You're correct. Subdomains are still considered separate domains when using iframes. It's possible to pass messages using postMessage(...), but other JS APIs are intentionally made inaccessible.

仍然可以根据上下文获取 URL.有关更多详细信息，请参阅其他答案.

It's also still possible to get the URL depending on the context. See other answers for more details.

这篇关于从 iframe 访问父 URL的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！