Nerd-puzzle: how might I allow sibling same-origin iframes to communicate, given…
- parent is cross-origin
- can’t execute JS on parent
- no sessionStorage, localStorage, cookies, or IDB access
- with enough security to share auth tokens?
Conversation
Replying to
Nope, alas: can’t access window.parent.frames cross-origin.
(to my surprise, Firefox allows this! but Chrome and Safari sensibly don’t)
2
Okay, I've seen one more weird trick, but it involves more coordination: triply embedded iframes
- origin 1
- origin 2
- origin 1
These sometimes offer possibilities for communicating, but you need help from origin 1
2
Show replies